Real-time CAN bus intrusion detection method based on historical feature module

Abstract

The invention discloses a real-time CAN (Controller Area Network) bus intrusion detection method based on a historical feature module, which comprises the following steps of: expanding a CAN ID (Identity) in a CAN bus message data stream into a 01 sequence according to a binary system, and stacking the 01 sequence of the CAN ID according to a time window W, so that time sequence data can be effectively converted into spatial data; according to the method, hidden modes and abnormal behaviors in data are disclosed, a more intuitive and structured data processing framework is provided for subsequent feature extraction and anomaly detection, and more comprehensive communication behavior features can be captured, so that the capability of identifying the abnormal behaviors is improved, communication modes changing along with time can be learned, and the communication efficiency is improved. The method has the advantages that the method is simple and easy to implement, the detection capability of the newly appearing attack mode is improved, the robustness of the model is improved, the confrontation training simulates strategies possibly adopted by attackers by introducing confrontation samples, the model can learn how to cope with the attacks in the training process, and unknown attacks can be better recognized and defended in the actual deployment process.

Description

Technical Field

[0001] The invention belongs to the technical field of network flow detection, and in particular, is a real-time CAN bus intrusion detection method based on a historical feature module. Background Art

[0002] Controller Area Network (CAN) is a real-time serial communication protocol bus that is now widely used in automobiles and other automation and industrial applications. In vehicles, the CAN bus protocol is used as a standard communication protocol for in-vehicle networks, connecting a large number of electronic control units (ECUs) in the vehicle. These electronic control units collaborate through the CAN bus to implement various functions of the vehicle and ensure the normal operation of the vehicle. However, the CAN bus lacks a security mechanism, which leads to serious security threats to the CAN bus. In particular, through remote connection channels such as cellular vehicle-to-everything (C-V2X), a potential attacker can hijack ECUs and sniff CAN bus traffic through security flaws of the CAN bus. In addition, by reverse engineering and analyzing the data collected from the CAN bus, attackers can perform injection attacks on the CAN bus and pose potential risks to the safety of target vehicles, pedestrians, and road infrastructure.

[0003] A large number of CAN bus intrusion detection systems have been proposed to detect cyber attacks on vehicles. Among these methods, deep learning-based methods have attracted great attention in recent years due to their effectiveness in identifying anomalies in high-dimensional or nonlinear time series data. Current supervised learning and semi-supervised learning-based methods encounter significant challenges in dealing with limited labeled data and previously unobserved dynamic anomalies, which are common scenarios in vehicle-borne network attack detection.

[0004] The existing CAN bus intrusion detection system faces the following problems:

[0005] (1) In terms of real-time performance, the high computational overhead of complex feature extraction and the serial processing process, coupled with the complex structure of the detection model leading to unstable reasoning time and the lack of a lightweight fast detection channel, seriously affect the system's real-time detection capability;

[0006] (2) In terms of data feature extraction, the existing system does not fully utilize the spatial correlation features between ECUs nodes and the CAN network topology features, which affects the detection capability of the model;

[0007] (3) The CAN bus traffic dependency cannot effectively capture the remote timing dependency, the correlation analysis between historical patterns and real-time data is insufficient, there is a lack of effective long-term dependency memory mechanism, and the long-term evolution law of timing features is not fully utilized. These problems make it difficult for the system to mine valuable security features from historical data;

[0008] (4) The existing intrusion detection system is not robust enough and can be easily deceived by malicious attacks, and is powerless against protocol compatibility attacks. The above four problems make it difficult for the existing network anomaly detection model to meet the actual application requirements and be applied in the industry. Summary of the invention

[0009] The present invention proposes a real-time CAN bus intrusion detection method based on a historical feature module. Aiming at the main defects of the current scheme, the present invention is implemented through the following technical scheme:

[0010] The present invention discloses a real-time CAN bus intrusion detection method based on a historical feature module, comprising:

[0011] 1) Set the number of training rounds to 3-10, the batch size to 32-64, the learning rate to 0.001, the adversarial perturbation ε to 0.01-0.02, and use all zero values ​​to initialize the historical information vector h;

[0012] 2) Collect at least 20,000 normal CAN bus message data streams with time stamps as a training set;

[0013] 3) Expand the CAN ID in the normal CAN bus message data stream into a 01 sequence according to binary, and stack the 01 sequence of the CAN ID according to the time window W, and convert the stacked two-dimensional square matrix into a CAN ID dot matrix;

[0014] 4) Extract the spatial and temporal features of the CAN ID dot map, and fuse the spatial and temporal features to obtain the spatiotemporal features V;

[0015] 5) The historical information vector h and the spatiotemporal feature V are fused to obtain h', and h is assigned to h', which is continuously updated in subsequent training;

[0016] 6) splicing h' and the spatiotemporal feature V, and reconstructing the CAN ID dot matrix based on the splicing result;

[0017] 7) Calculate the anomaly score between the reconstructed CAN ID dot map M' and the original CAN ID dot map M, and determine whether it is attack traffic based on the anomaly score;

[0018] 8) Use adversarial training method to train steps 4)-7);

[0019] As a further improvement, the present invention extracts the spatial features and time features of the CAN ID dot matrix, and fuses the spatial features and time features to obtain the spatiotemporal features V as follows:

[0020] For the CAN ID dot matrix M, the convolutional neural network CNN and the fully connected network MLP are used to extract the spatial features S and time features T of the dot matrix respectively. Before extracting the time feature T, the dot matrix M is expanded into a one-dimensional vector by the expansion function expand:

[0021] S=CNN(M), T=MLP(expand(M));

[0022] Concatenate the spatial feature S and the temporal feature T to obtain the spatiotemporal feature V:

[0023] V = concat(S,T).

[0024] As a further improvement, the present invention fuses the historical information vector h with the spatiotemporal feature to obtain h', assigns h to h', and continuously updates it in subsequent training as follows:

[0025] The historical information vector h is concatenated with the spatiotemporal feature V, and the historical information vector and the spatiotemporal feature are fused through a fully connected network to obtain the vector h':

[0026] h' = MLP(concat(h,V));

[0027] And use h' to replace h and use it as the historical information vector for the next training:

[0028] h=h';

[0029] Concatenate h' and V to get vector p:

[0030] p = concat(h',V);

[0031] The vector p contains the feature V of the current CAN bus message and the feature h' of the historical CAN bus message.

[0032] As a further improvement, the present invention splices h' and the spatiotemporal feature V, and reconstructs the CAN ID dot matrix based on the splicing result, specifically:

[0033] The vector p is reconstructed into a message dot matrix M' through the deconvolution layer DCNN:

[0034] M'=DCNN(M).

[0035] As a further improvement, the method of calculating the anomaly score between the reconstructed CAN ID dot map M' and the original CAN ID dot map M according to the present invention, and determining whether it is attack traffic according to the anomaly score is specifically as follows:

[0036] Calculate the mean square error (MSE) between the reconstructed message dot map M' and the original dot map M as the anomaly score:

[0037] MSE(x,y)=(xy) 2 ;

[0038] anomaly score = MSE(M,M');

[0039] During model training, only normal CAN bus message data is used as training data, and the training goal is to minimize the abnormal score of normal CAN bus messages, that is, the model can reconstruct normal CAN bus messages but cannot reconstruct abnormal CAN bus messages;

[0040] When the model is deployed, the anomaly score of the CAN bus message to be detected is calculated. If the anomaly score is greater than the threshold τ, the message to be detected is abnormal, otherwise it is a normal message.

[0041] As a further improvement, the adversarial training method described in the present invention is used to train steps 4)-7), specifically:

[0042] 6.1 Input normal dot matrix data, forward propagate to obtain the reconstruction result and calculate the reconstruction loss L1;

[0043] 6.2 Generate adversarial samples of input dot matrix sample x. For input dot matrix sample x, calculate the gradient of loss function:

[0044]

[0045] The perturbation η is calculated according to the gradient of the loss function:

[0046]

[0047] Generate adversarial samples x_adv of the input dot matrix based on perturbations:

[0048] x_adv=x+η;

[0049] 6.3 Optimize the model based on normal samples and adversarial samples. The steps are as follows:

[0050] Use the adversarial sample x_adv to forward propagate to obtain the reconstruction result and calculate the reconstruction loss L2. The overall optimization goal of the model is:

[0051] min_θL=(1-α)L2+αL1;

[0052] Where θ represents the model parameters, α is the adversarial loss weight, the legal value is [0,1], usually set to 0.3, L1 is the normal sample loss, and L2 is the adversarial sample loss;

[0053] According to the overall optimization goal of the model, backpropagation updates the parameters until convergence.

[0054] The beneficial effects of the present invention are as follows:

[0055] 1) The CAN ID in the CAN bus message data stream is expanded into a 01 sequence according to binary, and the 01 sequence of the CAN ID is stacked according to the time window W. The stacked two-dimensional square matrix is ​​converted into a CAN ID dot matrix. This method can effectively convert time series data into spatial data, making the CAN bus communication mode that was originally difficult to observe intuitively become visualized. This conversion not only helps to reveal hidden patterns and abnormal behaviors in the data, but also provides a more intuitive and structured data processing framework for subsequent feature extraction and anomaly detection;

[0056] 2) Extract the spatial and temporal features of the CAN ID dot map, and fuse the spatial and temporal features to obtain spatiotemporal features. The spatial features reflect the distribution of CAN IDs in the dot map, while the temporal features describe the changing trends of these IDs over time. After fusing these features, the model can capture more comprehensive communication behavior features, thereby improving the ability to identify abnormal behaviors;

[0057] 3) The historical information vector h is fused with the spatiotemporal features to obtain h', and h is assigned to h'. It is continuously updated in subsequent training to maintain the "memory" of historical traffic patterns. This method enables the model to use historical data to predict and identify new abnormal behaviors. By continuously updating h, the model can learn communication patterns that change over time, thereby improving the ability to detect emerging attack patterns;

[0058] 4) Splice h' and the spatiotemporal feature V, and reconstruct the CAN ID dot map based on the splicing result. This method can further verify the model's understanding of the CAN bus communication behavior. By reconstructing the dot map, the model can self-check its ability to interpret the data and ensure that the extracted features can effectively reflect the essence of the original data;

[0059] 5) Calculate the anomaly score between the reconstructed message dot map M' and the original dot map M, and use the anomaly score to perform unsupervised discrimination on the traffic, providing an unsupervised anomaly measurement method that can detect zero-day attacks;

[0060] 6) Use adversarial training methods to train the above steps to improve the robustness of the model. Adversarial training simulates the strategies that attackers may adopt by introducing adversarial samples, so that the model can learn how to deal with these attacks during the training process, so that it can better identify and defend against unknown attacks when actually deployed. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 It is a flow chart of the real-time CAN bus intrusion detection system based on the historical feature module;

[0062] Figure 2 This is a CAN bus message intrusion detection model diagram. DETAILED DESCRIPTION

[0063] The present invention discloses a real-time CAN bus intrusion detection method based on a historical feature module.

[0064] The technical solution of the present invention is further described below by a specific embodiment: A real-time CAN bus intrusion detection system based on a historical feature module of the present invention specifically comprises the following steps:

[0065] 1. Set the number of training rounds to 3-10, the batch size to 32-64, the learning rate to 0.001, the adversarial perturbation ε to 0.01-0.02, and use all zero values ​​to initialize the historical information vector h;

[0066] 2. Collect at least 20,000 normal CAN bus message data streams with time stamps as training sets;

[0067] 3. Expand the CAN ID in the normal CAN bus message data stream into a 01 sequence according to binary, and stack the 01 sequence of the CAN ID according to the time window W, and convert the stacked two-dimensional square matrix into a dot matrix;

[0068] 4. Extract the spatial and temporal features of the CAN ID dot map, and fuse the spatial and temporal features to obtain the spatiotemporal features V:

[0069] For the dot map M of the input message X, the convolutional neural network CNN and the fully connected network MLP are used to extract the spatial features S and time features T of the dot map. Before extracting the time feature T, the dot map M is expanded into a one-dimensional vector by the expansion function expand:

[0070] S=CNN(M), T=MLP(expand(M));

[0071] Concatenate the spatial feature S and the temporal feature T to obtain the spatiotemporal feature V:

[0072] V = concat(S,T);

[0073] 5. The historical information vector h is fused with the spatiotemporal features to obtain h', and h is assigned to h', which is continuously updated in subsequent training:

[0074] The historical information vector h is concatenated with the spatiotemporal feature V, and the historical information vector and the spatiotemporal feature are fused through a fully connected network to obtain the vector h':

[0075] h' = MLP(concat(h,V));

[0076] And use h' to replace h and use it as the historical information vector for the next training:

[0077] h=h';

[0078] Concatenate h' and V to get vector p:

[0079] p = concat(h',V);

[0080] The vector p contains the feature V of the current CAN bus message and the feature h' of the historical CAN bus message;

[0081] 6. Concatenate h' and the spatiotemporal features to obtain vector p, and reconstruct the CAN ID dot matrix based on the concatenation result:

[0082] The vector p is reconstructed into a message dot matrix M' through the deconvolution layer DCNN:

[0083] M' = DCNN(M);

[0084] 7. Calculate the anomaly score between the reconstructed CAN ID dot matrix M' and the original CAN ID dot matrix M, and determine whether it is attack traffic based on the anomaly score:

[0085] Calculate the mean square error MSE between the reconstructed CAN ID dot matrix M' and the original CAN ID dot matrix M as the anomaly score:

[0086] MSE(x,y)=(xy) 2 ;

[0087] anomaly score = MSE(M,M');

[0088] During model training, only normal CAN bus message data is used as training data, and the training goal is to minimize the abnormal score of normal CAN bus messages, that is, the model can reconstruct normal CAN bus messages but cannot reconstruct abnormal CAN bus messages;

[0089] When the model is deployed, the anomaly score of the CAN bus message to be detected is calculated. If the anomaly score is greater than the threshold τ, the message to be detected is abnormal, otherwise it is a normal message.

[0090] 8. Use adversarial training method to train steps 4)-7):

[0091] 8.1 Input normal CAN ID dot matrix data, forward propagate to obtain the reconstruction result and calculate the reconstruction loss L1;

[0092] 8.2 Generate adversarial samples of input dot matrix sample x. For the input dot matrix sample x, calculate the gradient of the loss function:

[0093]

[0094] The perturbation η is calculated according to the gradient of the loss function:

[0095]

[0096] Generate adversarial samples x_adv of the input dot matrix based on perturbations:

[0097] x_adv=x+η

[0098] 8.3 Optimize the model based on normal samples and adversarial samples. The steps are as follows:

[0099] Use the adversarial sample x_adv to forward propagate to obtain the reconstruction result and calculate the reconstruction loss L2. The overall optimization goal of the model is:

[0100] min_θL=(1-α)L2+αL1

[0101] Where θ represents the model parameters, α is the adversarial loss weight, the legal value is [0,1], usually set to 0.3, L1 is the normal sample loss, and L2 is the adversarial sample loss.

[0102] According to the overall optimization goal of the model, backpropagation updates the parameters until convergence.

[0103] 9. Deploy the trained intrusion detection model on the vehicle for intrusion detection;

[0104] The present invention uses F1-scores, precision and recall to evaluate the detection capability. The higher the F1-score, precision and recall, the stronger the network traffic anomaly detection capability.

[0105] Table 1 shows the intrusion detection effect of four attacks

[0106] s

[0107]

[0108] As shown in Table 1, this method has the best detection results. It has achieved the best detection results in four attack methods: DoS attack, Fuzzy attack, and sniffing attack on gear and RPM, and has practical application value.

[0109] Table 2 shows the detection speed of four attacks on CPU and GPU.

[0110]

[0111] As shown in Table 2, this method detects an average of 2692 and 8940 frames per second on the 11th-generation Intel i7 CPU and NVIDIA GeForce RTX 3060 GPU, respectively, with fast detection speed and real-time performance;

[0112] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of patent protection of the present invention. Under the enlightenment of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested for the present invention shall be based on the attached claims.

Claims

1. A real-time CAN bus intrusion detection method based on historical feature module, characterized in that: include: 1) Set the number of training rounds to 3-10, the batch size to 32-64, the learning rate to 0.001, the adversarial perturbation ε to 0.01-0.02, and use all zero values ​​to initialize the historical information vector h; 2) Collect at least 20,000 timestamped normal CAN bus message data streams as a training set; 3) Expand the CAN ID in the normal CAN bus message data stream into a 01 sequence according to binary, and stack the 01 sequence of the CAN ID according to the time window W, and convert the stacked two-dimensional square matrix into a CAN ID dot matrix; 4) Extract the spatial and temporal features of the CAN ID dot map, and fuse the spatial and temporal features to obtain the spatiotemporal feature V; 5) The historical information vector h and the spatiotemporal feature V are fused to obtain h', and h is assigned to h', which is continuously updated in subsequent training; 6) splicing h' and the spatiotemporal feature V, and reconstructing the CAN ID dot matrix based on the splicing result; 7) Calculate the anomaly score between the reconstructed CAN ID dot map M' and the original CAN ID dot map M, and determine whether it is attack traffic based on the anomaly score; 8) Use adversarial training method to train steps 4)-7); 9) Deploy the trained intrusion detection model on the vehicle for intrusion detection.

2. The real-time CAN bus intrusion detection method based on the historical feature module according to claim 1 is characterized in that: The extraction of the spatial features and time features of the CAN ID dot matrix, and the fusion of the spatial features and time features to obtain the spatiotemporal features V are specifically: For the CAN ID dot matrix M, the convolutional neural network CNN and the fully connected network MLP are used to extract the spatial features S and time features T of the dot matrix respectively. Before extracting the time feature T, the dot matrix M is expanded into a one-dimensional vector by the expansion function expand: S=CNN(M), T=MLP(expand(M)); Concatenate the spatial feature S and the temporal feature T to obtain the spatiotemporal feature V: V = concat(S,T).

3. The real-time CAN bus intrusion detection method based on historical feature module according to claim 1 is characterized in that: The above-mentioned fusion of the historical information vector h and the spatiotemporal features to obtain h', and assigning h to h', is continuously updated in subsequent training as follows: The historical information vector h is concatenated with the spatiotemporal feature V, and the historical information vector and the spatiotemporal feature are fused through a fully connected network to obtain the vector h': h' = MLP(concat(h,V)); And use h' to replace h and use it as the historical information vector for the next training: h=h'; Concatenate h' and V to get vector p: p = concat(h',V); The vector p contains the feature V of the current CAN bus message and the feature h' of the historical CAN bus message.

4. The real-time CAN bus intrusion detection method based on historical feature module according to claim 1 is characterized in that: The splicing of h' and the spatiotemporal feature V and reconstructing the CAN ID dot matrix based on the splicing result is specifically: The vector p is reconstructed into a message dot matrix M' through the deconvolution layer DCNN: M'=DCNN(M).

5. The real-time CAN bus intrusion detection method based on historical feature module according to claim 1 is characterized in that: The calculation of the anomaly score between the reconstructed CAN ID dot map M' and the original CAN ID dot map M, and determining whether it is attack traffic according to the anomaly score is specifically as follows: Calculate the mean square error MSE between the reconstructed message dot map M' and the original dot map M as the anomaly score anomalyscore: MSE(x,y)=(xy)2; anomaly score = MSE(M,M'); During model training, only normal CAN bus message data is used as training data, and the training goal is to minimize the abnormal score of normal CAN bus messages, that is, the model can reconstruct normal CAN bus messages but cannot reconstruct abnormal CAN bus messages; When the model is deployed, the anomaly score of the CAN bus message to be detected is calculated. If the anomaly score is greater than the threshold τ, the message to be detected is abnormal, otherwise it is a normal message.

6. The real-time CAN bus intrusion detection method based on the historical feature module according to claim 1 is characterized in that the adversarial training method is used to train steps 4)-7), specifically: 6.1 Input normal dot matrix data, forward propagate to obtain the reconstruction result and calculate the reconstruction loss L1; 6.2 Generate adversarial samples of input dot matrix sample x. For input dot matrix sample x, calculate the gradient of loss function: The perturbation η is calculated according to the gradient of the loss function: Generate adversarial samples x_adv of the input dot matrix based on perturbations: x_adv=x+η; 6.3 Optimize the model based on normal samples and adversarial samples. The steps are as follows: Use the adversarial sample x_adv to forward propagate to obtain the reconstruction result and calculate the reconstruction loss L2. The overall optimization goal of the model is: min_θL=(1-α)L2+αL1; Where θ represents the model parameters, α is the adversarial loss weight, the legal value is [0,1], usually set to 0.3, L1 is the normal sample loss, and L2 is the adversarial sample loss; According to the overall optimization goal of the model, backpropagation updates the parameters until convergence.

Images