Vehicle-mounted network intrusion prediction method of fuzzy neural network based on gating circulation unit

Abstract

The invention relates to the technical field of electric vehicle on-board networks, in particular to an on-board network intrusion prediction method based on a fuzzy neural network of a gating circulation unit, which comprises the following steps of: preprocessing original data, cleaning and converting the data, reducing noise, normalizing and the like; and the data can be quickly browsed and analyzed by a subsequent deep learning model. Carrying out noise reduction and abnormal value detection on the original data by adopting a noise filter and a data sorting and classifying method; a naive Bayes classifier is adopted to process the feature value missing problem; and normalizing the original data by using a maximum and minimum normalization method. Based on a fuzzy neural network model improved by a back propagation learning algorithm, the defect that a traditional artificial neural network can only utilize current data to predict network attack of a single source is overcome, and a gating circulation unit is adopted to reduce gating signals of the fuzzy neural network model to two so as to predict label features of current network attack behaviors.

Description

Technical Field

[0001] The invention relates to the technical field of electric vehicle on-board networks, and in particular to an on-board network intrusion prediction method based on a fuzzy neural network of a gated cyclic unit. Background Art

[0002] With the continuous rise of electric vehicles and the continuous development of in-vehicle networks towards intelligence, the security issues faced by in-vehicle networks are becoming more and more severe. Due to the increasing intensity and number of external network attacks, it is necessary to continuously monitor and analyze the large amount of data transmitted worldwide. As a hot network intrusion method, neural network models are widely used in the field of network security. Neural network prediction models help administrators predict various attacks and intrusions and actively discover potential dangerous intrusions between various data sharing platforms. In addition, during the defensive attack prediction period, the intrusion prediction model can also perform real-time analysis on the collected key system data, thereby improving the accuracy of predicting network intrusions from historical data and real-time data.

[0003] Although the network intrusion prediction method based on neural network has achieved certain success in predicting data attacks, the neural network model still has limitations in practice. The neural network model only allows the prediction of the expected number of attacks in the future time interval, and can only effectively predict attacks from specific sources. In order to effectively solve these problems, a network intrusion detection method based on unsupervised and supervised fusion deep reinforcement learning is designed in the Chinese patent application number CN202310622371.2. The invention mixes unsupervised data with supervised data to construct a contaminated data set to simulate the real scene of network intrusion; uses a combination of unsupervised learning and deep reinforcement learning to construct an intrusion detection model to detect intrusion behavior in the target network; uses the contaminated data set to train the intrusion detection model and adjust the model parameters so that it can accurately identify and classify different types of intrusion attacks; uses the trained intrusion detection model to perform real-time intrusion detection on the target network, and promptly discovers and responds to network intrusion behavior. By fusing unsupervised and supervised data, the network intrusion scene can be simulated more realistically, and the accuracy and robustness of the detection model can be improved. Another example is the Chinese patent application number CN202311622687.8, which designs a BP neural network intrusion detection method based on the dung beetle optimization algorithm. The invention uses the dung beetle optimization algorithm to optimize the initial threshold and initial weight of the BP neural network to obtain the optimal initial parameters; obtain historical network traffic data and construct a training sample set; use the training sample set to train the BP neural network with the optimal initial parameters, evaluate the model performance through the recall rate, repeat the iteration until the recall rate is greater than the set threshold D1, and obtain the network intrusion detection model; collect real-time network traffic data and input it into the pre-trained network intrusion detection model to obtain the network intrusion detection results. The false alarm rate and false alarm rate of the network intrusion detection model are reduced, and the security and reliability of the system are improved.

[0004] The network intrusion detection methods described above all focus on predicting the future attack behavior of a single target, or the future behavior of a complex attack. However, protecting a single network is not the goal of predicting network attacks. Collecting and analyzing attack data of multiple networks and predicting the attack behavior of multiple networks are one of the most important goals. Therefore, the present invention provides a vehicle network intrusion prediction method based on a fuzzy neural network of a gated recurrent unit to overcome the shortcoming that traditional artificial neural networks can only use current data to predict attacks from a single source network. It can not only predict the probability of an attack being observed, but also predict the specific parameters of the expected attack (such as its type, intensity and target), so that the vehicle network of electric vehicles can apply better defense measures. Summary of the invention

[0005] To solve the above problems, the present invention provides a vehicle network intrusion prediction method based on a fuzzy neural network of a gated recurrent unit, which is used to overcome the shortcoming that traditional artificial neural networks can only use current data to predict network attacks from a single source. It can not only predict the probability of observing an attack, but also predict the specific parameters of the expected attack, so that the vehicle network of electric vehicles can establish better defense measures.

[0006] In order to achieve the above-mentioned purpose, the technical scheme of the present invention is as follows: a vehicle network intrusion prediction method based on a fuzzy neural network of a gated recurrent unit, comprising the following steps: S1, data preprocessing; performing preprocessing operations on the collected raw data to obtain training data;

[0007] S2. Design of fuzzy neural network model; improve the fuzzy neural network model based on the back propagation learning algorithm, and then substitute the training data into the fuzzy neural network model to extract feature values;

[0008] S3, gated recurrent unit design: using gated recurrent unit to reduce the gating signal of fuzzy neural network model to two, designing three different control signal variants, and uniformly applying them to two gating signals;

[0009] S4. Design of network intrusion predictor: Based on the fuzzy neural network and gated recurrent unit model, a network intrusion prediction method is established, and the label features of the current network attack behavior are predicted by the network intrusion prediction method, and the label features include normal or abnormal;

[0010] S5. Complete system execution; after preprocessing the raw data, the design of the vehicle network intrusion predictor is completed with the help of fuzzy neural network and gated recurrent unit model.

[0011] Further, in S1, the preprocessing operation includes cleaning and transforming the raw data, denoising and normalizing the data.

[0012] Furthermore, in the preprocessing operation, a noise filter is used for noise reduction, and the model of the noise filter is as follows:

[0013]

[0014]

[0015] Among them, x i is the input data, p i+1 is the encoder process function, f and h are the convolution activation functions, ω is the filter, and λ is the bias value.

[0016] Furthermore, in the preprocessing operation, the steps of cleaning and conversion are as follows: after sorting the original data, the ones with higher values ​​are taken as outliers (outliers in the data set); the outlier detection model is as follows:

[0017]

[0018]

[0019] Among them, S(x,n) is the detection model, E(n) is the process function, n is the number of outliers, H(x C ) is the average of all data, M and N are bias values.

[0020] Furthermore, in the preprocessing operation, the cleaning and conversion steps also include: after removing noise and outliers from the original data, a data set B to be classified is established, the data set B to be classified is processed by a naive Bayes classifier model to obtain an improved data set, and the improved data set is used as input data v for normalization processing;

[0021] Among them, the naive Bayes classifier model is as follows:

[0022]

[0023] Among them, B is the data set to be classified, C={C1,C2,…,C j} is the classification label of the dataset.

[0024] Furthermore, in the preprocessing operation, the normalization process is as follows: first, the input data v is substituted into the maximum and minimum normalization formula to obtain the input data x of the fuzzy neural network model. i ;

[0025] The maximum and minimum normalization formula is as follows;

[0026]

[0027] Among them, v is the data set to be normalized, v′ is the data set after normalization, mean, max_value, min_value are the mean, maximum and minimum values ​​of the data set respectively.

[0028] Further, in S2, the fuzzy neural network model is improved based on the back propagation learning algorithm as follows:

[0029]

[0030]

[0031] Among them, n is the number of iterations, T is the number of nodes in the fuzzy layer and the output layer, η is the learning rate of the back-propagation learning algorithm, and α is the back-propagation learning factor.

[0032] Further, in S3, the gate control signals i of the input layer, fuzzy layer and output layer corresponding to the fuzzy neural network model are obtained. t ,F t ,o t , the gating signal i of the input layer, fuzzy layer and output layer t ,F t ,o t It can be expressed as:

[0033] i t =σ(w i x t +V i o t )+b i ;

[0034] F t =σ(μ i x t +V f o t )+b f ;

[0035] o t =σ(z i x t +V o o t )+b o ;

[0036] Among them, σ is a nonlinear function, V i ,V f ,V o and b i ,b f ,b o are the control matrices and bias values ​​for the input layer, fuzzy layer, and output layer respectively;

[0037] Then substitute the gating signal of the fuzzy neural network model into the gated recurrent unit to obtain two control signals, namely the update gate and the reset gate. The gated recurrent unit model is shown below;

[0038]

[0039] Among them, gt is the gating signal.

[0040] Further, in S4, the steps of the network intrusion prediction method are as follows: suppose the latest continuous network connection record sequence X, each record in X has N-1 connection features and 1 label feature, and the next network connection record X is used nextGiven the latest network connection record prediction, the network intrusion prediction method is defined as;

[0041]

[0042] Among them, X is the latest continuous network connection record sequence, X next Recorded for the next network connection.

[0043] Further, in S4, the next network connection record X is used next When predicting based on the latest network connection records, data normalization is performed. The data normalization process is as follows:

[0044]

[0045]

[0046]

[0047] in, and k are the mean and variance of the kth dimension of the dataset, respectively.

[0048] The above scheme has the following beneficial effects:

[0049] 1. This scheme uses noise filters and data sorting and classification methods to reduce noise and detect outliers in the original data; uses a naive Bayes classifier to deal with the problem of missing eigenvalues; and uses the maximum and minimum normalization method to normalize the original data.

[0050] 2. This solution uses a fuzzy neural network model improved by the back-propagation learning algorithm to overcome the shortcoming that traditional artificial neural networks can only use current data to predict single-source network attacks. The gated recurrent unit is then used to reduce the gating signal of the fuzzy neural network model to two, and three different control signal variants are designed and uniformly applied to the two gating signals to facilitate the subsequent acquisition of label features.

[0051] 3. This solution, based on the fuzzy neural network and gated recurrent unit model, designs a network intrusion prediction system to predict the label characteristics (normal or abnormal) of the current network attack behavior. The present invention can not only predict the probability of an observed attack, but also predict the specific parameters of the expected attack (such as its type, intensity and target), so that the vehicle-mounted network of electric vehicles can apply better defense measures.

[0052] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A data preprocessing design block diagram of an embodiment of a vehicle network intrusion prediction method based on a fuzzy neural network of a gated recurrent unit according to the present invention;

[0054] Figure 2 A fuzzy neural network model design block diagram of an embodiment of a vehicle network intrusion prediction method based on a fuzzy neural network of a gated recurrent unit according to the present invention;

[0055] Figure 3 This is a control block diagram of a gated recurrent unit model of an embodiment of a vehicle network intrusion prediction method based on a fuzzy neural network of a gated recurrent unit according to the present invention. DETAILED DESCRIPTION

[0056] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] The following is further described in detail through specific implementation methods:

[0058] As attached Figures 1 to 3 As shown: A vehicle network intrusion prediction method based on a fuzzy neural network of a gated recurrent unit includes the following steps: including the following steps: S1, data preprocessing; performing preprocessing operations on the collected raw data, the preprocessing operations include cleaning and converting the raw data, denoising and normalizing the raw data to obtain training data; so that the subsequent deep learning model can quickly browse and analyze these data.

[0059] In network attacks, the first step to achieve network intrusion prediction is to preprocess the collected raw data, clean and convert the data, reduce noise and normalize the data, so that the subsequent fuzzy neural network can quickly browse and analyze the data. The data preprocessing design diagram is shown in the attached figure. Figure 1 Specifically, the preprocessing of data can ensure that the network model can analyze the characteristics of the data in a timely manner. Data preprocessing is the most important and influential factor for the generalization performance of machine learning algorithms.

[0060] Since fuzzy neural networks are very sensitive to the presence of noise, noise in the data can cause misclassification, and similarity metrics can be easily falsified by data containing noise in the values. Noise filters are usually used to discover and remove noise in the data. The model of the noise filter is as follows:

[0061]

[0062]

[0063] Among them, x i is the input data, p i+1 is the encoder process function, f and h are the convolution activation functions, ω is the filter, and λ is the bias value.

[0064] Furthermore, in addition to the influence of noise values, the appearance of data set values ​​may also be called outliers, that is, outliers in the data set. The present invention designs a method for creating data sorting and classification, and after sorting the data, the values ​​with higher values ​​are regarded as outliers. The detection model of outliers is as follows:

[0065]

[0066]

[0067] Among them, S(x,n) is the detection model, E(n) is the process function, n is the number of outliers, H(x C ) is the average of all data, M and N are bias values.

[0068] Therefore, the original data is used to establish a dataset B to be classified after removing noise and outliers. At the same time, the problem of missing feature values ​​is one of the main problems that must be solved in the data preprocessing process. Most of the datasets in actual electric vehicles contain incomplete information, that is, a small part or a large part of the dataset is missing. The naive Bayes classifier shows stable performance in the dataset containing missing values, and the final result after the classifier processing is not affected by the missing values. The naive Bayes classifier model used in the present invention is as follows:

[0069]

[0070] Among them, B is the data set to be classified, C={C1,C2,…,C j} is the classification label of the dataset.

[0071] After the data set B to be classified is processed by the naive Bayes classifier model, an improved data set is obtained, and the improved data set is used as the input data v for normalization processing.

[0072] Furthermore, in the data sets collected for vehicle systems, there are often large differences between feature values, such as maximum and minimum values. The large differences between feature values ​​cannot be ignored and require careful intervention to ensure that all attribute values ​​are scaled and converted in an appropriate and acceptable manner. Substituting the input data v into the maximum and minimum normalization formula, the input data x of the fuzzy neural network model is obtained. i The maximum and minimum normalization method used in the present invention is as follows:

[0073]

[0074] Among them, v is the data set to be normalized, v′ is the data set after normalization, mean, max_value, min_value are the mean, maximum and minimum values ​​of the data set respectively.

[0075] S2. Design of fuzzy neural network model; Improve the fuzzy neural network model based on the back propagation learning algorithm, and then convert the training data x i Substitute the fuzzy neural network model to extract the feature value to overcome the disadvantage that the traditional artificial neural network can only use the current data to predict the network attack from a single source. The design block diagram of the fuzzy neural network model is shown in the attached figure. Figure 2 shown.

[0076] First, assume that the fuzzy layer has N nodes, each node represents a vector x i The fuzzy attribute function of the jth input variable in the fuzzy neural network input layer model is as follows:

[0077]

[0078] Among them, F ijk is the kth output variable of the input layer, w ijk The input variable x i and the weight between the kth input layer node.

[0079] The fuzzy layer function n of the fuzzy neural network model l and h l And the output layer function n m and h m Respectively expressed as:

[0080]

[0081]

[0082] Among them, v kl and z lm are the weight matrices corresponding to the fuzzy layer and the output layer respectively, and M and K are the number of nodes in the fuzzy layer and the output layer respectively.

[0083] Next, the weights between the fuzzy layer and the output layer are calculated by the back propagation learning algorithm δ kl The adjustments are as follows:

[0084]

[0085]

[0086] Among them, n is the number of iterations, T is the number of nodes in the fuzzy layer and the output layer, η is the learning rate of the back-propagation learning algorithm, and α is the back-propagation learning factor.

[0087] Furthermore, the error function Q of the fuzzy neural network model improved by the back propagation learning algorithm is:

[0088]

[0089] Among them, t m is the expected output value of the mth output node.

[0090] S3, gated recurrent unit design;

[0091] First, based on the network architecture obtained by the fuzzy neural network model improved by the back propagation learning algorithm, the control block diagram of the gated recurrent unit model is shown in the attached figure. Figure 3 As shown, the gated signals i of the input layer, fuzzy layer and output layer are t ,F t ,o t It can be expressed as:

[0092] i t =σ(w i x t +V i o t )+b i ;

[0093] F t =σ9μ i x t +V f o t )+b f ;

[0094] o t =σ(z i x t +V o o t )+b o ;

[0095] Among them, σ is a nonlinear function, V i ,V f ,V o and b i ,b f ,b o are the control matrices and bias values ​​for the input layer, fuzzy layer, and output layer respectively;

[0096] The gated recurrent unit reduces the gating signal of the fuzzy neural network model to two. These two control signals are called the update gate and the reset gate. The gated recurrent unit model is as follows:

[0097]

[0098] Among them, gt and rt are gating signals.

[0099] Furthermore, the two updated gating signals are:

[0100]

[0101] In the gated recurrent unit model, the update of weights and bias values ​​involves information related to the entire network model. Therefore, all information about the current input and fuzzy layer is reflected in the latest state variables. The present invention designs three different control signal variants, which are uniformly applied to two gates:

[0102] Variant 1: where each gate is computed using only the previous weight and bias values:

[0103]

[0104] Variant 2: where each gate uses only the previous weights to compute:

[0105]

[0106] Variant 3: where each gate is computed using only the previous bias value:

[0107]

[0108] S4. Design of network intrusion predictor: Based on the fuzzy neural network and gated recurrent unit model, a network intrusion prediction method is established, and the label features of the current network attack behavior are predicted by the network intrusion prediction method, and the label features include normal or abnormal.

[0109] Since the vehicle network system will record the attack behaviors that attempt to change, destroy or steal data, as well as exploit or damage the network, based on the network connection records collected from the system, based on the fuzzy neural network and gated recurrent unit model, the current state of the network connection record is assumed to depend on the latest network connection record sequence. Given the latest continuous network connection record sequence X, each record in X has N-1 connection features and 1 label feature (normal or abnormal). The next network connection record X next Given the latest network connection record prediction, label features (normal or abnormal) are also predicted.

[0110] Therefore, the network intrusion prediction method is defined as:

[0111]

[0112] Among them, X is the latest continuous network connection record sequence, X next Recorded for the next network connection.

[0113] Furthermore, according to the defined network intrusion prediction method, assuming that a network attack behavior is correctly predicted by the latest continuous network behavior, it is necessary to reduce the dimension of the input vector, so as to obtain some important features of the intrusion prediction system. Before analyzing the data set, the data must be standardized. The data standardization process is described as follows:

[0114]

[0115]

[0116]

[0117] in, and k are the mean and variance of the kth dimension of the dataset, respectively.

[0118] The data normalization process transforms the mean of the feature value set to zero and the standard deviation to 1. ′ ik It may not be in the interval [0, 1], and is handled as follows:

[0119]

[0120] Furthermore, in order to select important features, we design x i and x j The correlation coefficients between them are as follows:

[0121]

[0122] S5. Complete system execution; after preprocessing the raw data, the design of the vehicle network intrusion predictor is completed with the help of fuzzy neural network and gated recurrent unit model.

[0123] For example, a fuzzy neural network model with a gated recurrent unit is a model that can effectively learn long-term dependencies in sequence data. Unlike traditional neural networks, the learning process of the model does not rely on artificially created features. The fuzzy neural network model obtains a series of previous alarms based on data preprocessing and predicts the specific attributes of the next network intrusion behavior, such as the category, number, target IP or approximate time of the network attack, so as to apply defense measures in the vehicle network of the electric vehicle very accurately. The above method can predict future network intrusion attack events with reasonable accuracy and estimate the extent and category of the attack, help predict network attack behaviors and solve network security risks, and help the vehicle network defend against network intrusion behaviors.

[0124] Obviously, the above embodiments are merely examples for the purpose of clear explanation, and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the invention.

Claims

1. A vehicle network intrusion prediction method based on a fuzzy neural network with a gated recurrent unit, characterized in that: The following steps are involved: S1, data preprocessing; Perform preprocessing operations on the collected raw data to obtain training data; S2, fuzzy neural network model design; Improve the fuzzy neural network model based on the back propagation learning algorithm, and then substitute the training data into the fuzzy neural network model to extract the feature value; S3, gated recurrent unit design: using gated recurrent unit to reduce the gating signal of fuzzy neural network model to two, designing three different control signal variants, and uniformly applying them to two gating signals; S4. Design of network intrusion predictor: Based on the fuzzy neural network and gated recurrent unit model, a network intrusion prediction method is established, and the label features of the current network attack behavior are predicted by the network intrusion prediction method, and the label features include normal or abnormal; S5. Complete system execution; after preprocessing the raw data, the design of the vehicle network intrusion predictor is completed with the help of fuzzy neural network and gated recurrent unit model.

2. The vehicle network intrusion prediction method based on fuzzy neural network of gated recurrent unit according to claim 1 is characterized in that: In S1, the preprocessing operations include cleaning and transforming the raw data, denoising, and normalizing them.

3. The vehicle network intrusion prediction method based on fuzzy neural network of gated recurrent unit according to claim 2 is characterized in that: In the preprocessing operation, a noise filter is used for noise reduction. The model of the noise filter is as follows: Among them, x i is the input data, p i+1 is the encoder process function, f and h are the convolution activation functions, ω is the filter, and λ is the bias value.

4. The vehicle network intrusion prediction method based on fuzzy neural network of gated recurrent unit according to claim 3 is characterized in that: In the preprocessing operation, the steps of cleaning and conversion are as follows: after sorting the original data, the ones with higher values ​​are taken as outliers; the outlier detection model is as follows: Among them, S(x,n) is the detection model, E(n) is the process function, n is the number of outliers, H(x C ) is the average of all data, M and N are bias values.

5. The vehicle network intrusion prediction method based on fuzzy neural network of gated recurrent unit according to claim 4 is characterized in that: In the preprocessing operation, the cleaning and conversion steps also include: after removing noise and outliers from the original data, a data set B to be classified is established; after the data set B to be classified is processed by a naive Bayes classifier model, an improved data set is obtained; and the improved data set is used as input data v for normalization processing; Among them, the naive Bayes classifier model is as follows: Among them, B is the data set to be classified, C={C1,C2,…,C j } is the classification label of the dataset.

6. The vehicle network intrusion prediction method based on fuzzy neural network of gated recurrent unit according to claim 5 is characterized in that: In the preprocessing operation, the normalization process is as follows: Substitute the input data v into the maximum and minimum normalization formula to obtain the input data x of the fuzzy neural network model. i ; The maximum and minimum normalization formula is as follows; Among them, v is the data set to be normalized, v′ is the data set after normalization, mean, max_value, and min_value are the mean, maximum, and minimum values ​​of the data set, respectively.

7. The vehicle network intrusion prediction method based on fuzzy neural network of gated recurrent unit according to claim 6 is characterized in that: In S2, the fuzzy neural network model is improved based on the back propagation learning algorithm as follows: Among them, n is the number of iterations, T is the number of nodes in the fuzzy layer and the output layer, η is the learning rate of the back propagation learning algorithm, and α is the back propagation learning factor.

8. The vehicle network intrusion prediction method based on fuzzy neural network of gated recurrent unit according to claim 7 is characterized in that: In S3, the gate control signals i of the input layer, fuzzy layer and output layer corresponding to the fuzzy neural network model are obtained. t ,F t ,o t , the gating signal i of the input layer, fuzzy layer and output layer t ,F t ,o t It can be expressed as: i t =σ(w i x t +V i o t )+b i ; F t =σ(μ i x t +V f the t )+b f ; about t =σ(z i x t +V o about t )+b o ; Among them, σ is a nonlinear function, V i ,V f ,V o and b i ,b f ,b o are the control matrices and bias values ​​for the input layer, fuzzy layer, and output layer respectively; Then substitute the gating signal of the fuzzy neural network model into the gated recurrent unit to obtain two control signals, namely the update gate and the reset gate. The gated recurrent unit model is shown below; Among them, gt is the gating signal.

9. The vehicle network intrusion prediction method based on fuzzy neural network of gated recurrent unit according to claim 8 is characterized in that: In S4, the steps of the network intrusion prediction method are as follows: suppose the latest continuous network connection record sequence X, each record in X has N-1 connection features and 1 label feature, and the next network connection record X is used next Given the latest network connection record prediction, the network intrusion prediction method is defined as; Among them, X is the latest continuous network connection record sequence, X next Recorded for the next network connection.

10. The vehicle network intrusion prediction method based on fuzzy neural network of gated recurrent unit according to claim 9 is characterized in that: In S4, when the next network connection record X is adopted next When predicting based on the latest network connection records, data normalization is performed. The data normalization process is as follows: in, and k are the mean and variance of the kth dimension of the dataset, respectively.

Images