Vehicle-mounted CAN network intrusion detection method and system based on LSTM

Abstract

The invention discloses a vehicle-mounted CAN network intrusion detection method and system based on LSTM, and belongs to the field of automobile network security. The method comprises the following steps: constructing a CAN message data set with time sequence characteristics; constructing a CAN network intrusion detection model based on the LSTM; the CAN message data set is applied to training and testing of the detection model; and performing CAN network intrusion detection by using the trained detection model, and processing a detection result to give an alarm to a user. According to the invention, the process is simple, and the vehicle-mounted CAN network intrusion detection with high real-time performance, high precision and portability is realized.

Description

Technical Field

[0001] The present invention belongs to the field of automobile network security, and in particular, the present invention relates to a vehicle-mounted CAN network intrusion detection method and system based on LSTM. Background Art

[0002] In recent years, intelligent connected vehicles have developed rapidly. Functions such as remote control, intelligent assisted driving, and 5G in-vehicle applications have made people's travel more convenient, but also brought network security risks. On August 23, 2024, the Ministry of Industry and Information Technology issued the mandatory standard "GB44495-2024 Technical Requirements for Vehicle Information Security", which made strong requirements for automotive network security. CAN network is the most widely used in-vehicle communication protocol in the current automotive industry, but the protocol did not consider network security issues at the beginning of its design, that is, it lacked confidentiality, integrity and authenticity verification. Therefore, protecting in-vehicle CAN network communication is a vital task and has great research significance for society and the economy. The in-vehicle CAN network intrusion detection system can collect, monitor, identify and detect CAN messages in communication in real time, and is one of the preferred methods for in-vehicle CAN protection. In the current research technology, anomaly detection based on machine learning is the mainstream method. This intrusion detection method establishes a model based on machine learning algorithm training, and uses the model for classification or prediction to identify abnormal CAN data. It is known for its high accuracy and availability.

[0003] However, the current technology still has the following defects that need to be solved:

[0004] 1. Use simple or complex feature extraction methods, such as selecting only the CAN ID as a feature and simply binarizing it or converting the CAN data into an image after one-hot encoding for processing;

[0005] 2. Stacking overly complex machine learning algorithms for modeling results in bloated models, which are difficult to implement in actual deployment.

[0006] These defects undoubtedly increase the complexity of data processing, thereby affecting the actual detection accuracy. They also place higher requirements on the performance of models and equipment, and on the technology of automobile companies in the actual research and development process.

[0007] To this end, the present invention proposes a vehicle-mounted CAN network intrusion detection method and system based on LSTM. Summary of the invention

[0008] The present invention aims to overcome the deficiencies of the prior art and proposes a vehicle-mounted CAN network intrusion detection method and system based on LSTM to achieve the following objectives: to achieve high real-time, high-precision and lightweight vehicle-mounted CAN network intrusion detection.

[0009] In order to achieve the above object, the technical solution adopted by the present invention is: a vehicle-mounted CAN network intrusion detection method based on LSTM, the method comprising the following steps:

[0010] Step S1, constructing a CAN message data set with timing characteristics;

[0011] Step S2: construct a CAN network intrusion detection model based on LSTM;

[0012] Step S3, applying the CAN message data set to the training and testing of the detection model;

[0013] Step S4: Use the trained detection model to perform CAN network intrusion detection, and process the detection results to warn the user.

[0014] Preferably, the step S1 comprises:

[0015] Step S11, collecting CAN messages in the historical vehicle communication process and removing redundancy;

[0016] Step S12: Record the arrival timestamp of the message, and calculate the time difference between it and the previous message if the ID is the same;

[0017] Step S13, combining the time difference with the corresponding ID and performing binarization processing to obtain a corresponding binary string;

[0018] Step S14: label and classify the binary strings, wherein a normal binary string is marked as 1, and an abnormal binary string, that is, a binary string that is attacked by a network, is marked as 0; and so on, ultimately forming a CAN message data set with timing characteristics.

[0019] Preferably, in step S2, the detection model includes an input layer, an LSTM layer, a Dense layer, and an output layer connected in sequence.

[0020] Preferably, the detection model also includes a Dropout layer, wherein the Dropout layer is connected between the output of the LSTM layer and the input of the Dense layer.

[0021] Preferably, the detection model also includes an attention mechanism layer, wherein the attention mechanism layer is connected between the output of the Dense layer and the input of the output layer.

[0022] Preferably, in step S4, the detection result output by the detection model is a number between 0 and 1, wherein the detection results with numbers less than a preset value are uniformly recorded as 0, and the detection results with numbers greater than or equal to the preset value are uniformly recorded as 1; consistent with the label of the data set, 1 indicates normal, and 0 indicates being under a network attack.

[0023] Preferably, in step S4, the occurrence of the number 0 is also counted, and each time the detection result is 0, the counter is incremented by one, and when the counter reaches a preset threshold, an alarm is issued to the user.

[0024] At the same time, according to the above method, the present application also proposes an LSTM-based vehicle-mounted CAN network intrusion detection system, the system including a data acquisition module, an LSTM detection module, and a detection result processing module, wherein the data acquisition module is used to collect CAN messages in vehicle-mounted communications in real time and send them to the LSTM detection module after processing; the LSTM detection module is used to perform intrusion detection on CAN messages through a trained detection model; the detection result processing module is used to identify the output results of the LSTM detection module and after identifying network intrusion, warn the user and report the abnormal log to the security operation cloud platform.

[0025] Preferably, the system is integrated into a vehicle-mounted central gateway.

[0026] Preferably, the data acquisition module includes an OBD adapter, a PCAN connecting cable, and a PCANView host computer, wherein one end of the OBD adapter is connected to the vehicle-mounted OBD, and the other end is connected to the serial port end of the PCAN connecting cable; the USB end of the PCAN connecting cable is connected to the PCANView host computer; the PCANView host computer is used to collect and process CAN messages in vehicle communications through the vehicle-mounted OBD, and is also used to simulate network attack messages for detection model training.

[0027] The technical effects of the present invention are:

[0028] (1) The present invention extracts effective features of CAN data and simplifies the processing flow, avoiding converting text sequences into images, thereby increasing model training costs and storage and computing resource costs of vehicle-mounted components;

[0029] (2) The present invention extracts the time interval and ID of the same ID as features, effectively grasping the core characteristics of CAN data, namely, time characteristics and arbitration characteristics, without using the data domain, because the data domain will increase the dimension of the feature matrix and needs to be developed in high dimension with the communication matrix;

[0030] (3) The model uses the LSTM algorithm for training, and does not superimpose other deep learning algorithms such as convolutional neural network algorithms or autoencoders. The Dropout and attention mechanisms are used to optimize the model to obtain a lightweight detection model that can achieve high accuracy while adapting to the high real-time requirements of vehicle communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 The figure is a schematic diagram of the structure of a CAN network intrusion detection model based on LSTM according to an embodiment of the present invention;

[0032] Figure 2 This is a schematic diagram of the CAN data frame format according to an embodiment of the present invention;

[0033] Figure 3 This is a schematic diagram of ID binarization processing according to an embodiment of the present invention;

[0034] Figure 4 This is a schematic diagram of the LSTM framework of an embodiment of the present invention;

[0035] Figure 5 Schematic diagram of a confusion matrix according to an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The following is a further detailed description of the specific implementation of the present invention by describing the embodiments with reference to the accompanying drawings, with the purpose of helping those skilled in the art to have a more complete, accurate and in-depth understanding of the inventive concept and technical solution of the present invention and to facilitate its implementation. In order to make the technical solution of the present invention clearer, the present invention is explained by the following embodiments.

[0037] This embodiment proposes a vehicle-mounted CAN network intrusion detection method based on LSTM, and the method includes the following steps:

[0038] Step S1, constructing a CAN message data set with timing characteristics;

[0039] Step S2: construct a CAN network intrusion detection model based on LSTM; the detection model of this embodiment is as follows Figure 1 shown.

[0040] Step S3, applying the CAN message data set to the training and testing of the detection model;

[0041] Step S4: Use the trained detection model to perform CAN network intrusion detection, and process the detection results to warn the user.

[0042] Specifically, for step S1, the preprocessing of data during data set construction is related to whether the convergence speed of the model training is fast enough and whether the accuracy of the detection model is high enough. A CAN data frame format is as follows: Figure 2 As shown in the figure, ID is the arbitration field, which indicates the communication priority of the CAN message. The CAN message with a smaller ID has a higher priority. The standard frame is 11 bits, and the extended frame is 29 bits; DATA represents the data field, which is 8 bytes long.

[0043] Based on the CAN data frame format, in order to simplify the process and improve the detection accuracy, it is necessary to effectively grasp the core characteristics of CAN data, namely the time characteristics and arbitration characteristics. Therefore, this embodiment extracts the time difference and ID of the same ID message as features. Specifically, step S1 of this embodiment includes:

[0044] Step S11: collect CAN messages in the historical vehicle communication process and remove redundancy and formatting operations, thereby improving data quality and providing a more reliable basis for subsequent data analysis and modeling.

[0045] Step S12, record the arrival timestamp of the message, and calculate the time difference between it and the previous message under the premise that the ID is the same. In this embodiment, the difference is converted into a binary string, and the length is set to 16 bits. In the specific implementation, a dynamic table of "ID-timestamp" can be constructed, which records the arrival timestamp of the previous message of each ID, and is used to calculate the time difference with the previous message when the CAN message of the current ID is collected. It is worth noting that in actual application, the table is maintained in the cache of the central gateway, vehicle computer and other devices, and it will be reset every time the vehicle is powered on again. In addition, the number of IDs is limited, and it will not cause excessive consumption of computing resources and storage resources.

[0046] Step S13: Binarize the time difference and the corresponding ID to obtain a corresponding binary string. Since the time difference has been binarized, the ID is binarized again. The ID binarization process is as follows: Figure 3 As shown, the ID of the standard frame is padded with 0 in the high bit to complete the length of 29 bits. Finally, the binary string of the time difference and the ID is concatenated to form a length of 45 bits.

[0047] Step S14: label and classify the binary strings, wherein a normal binary string is marked as 1, and an abnormal binary string, that is, a binary string that is attacked by a network, is marked as 0; and so on, ultimately forming a CAN message data set with timing characteristics.

[0048] After the CAN message data set is constructed, based on its time series characteristics, this embodiment performs modeling based on LSTM (Long Short-Term Memory Network) in step S2. Figure 1 As shown, the detection model includes an input layer, an LSTM layer, a Dense layer, and an output layer connected in sequence. At the same time, in order to further meet the real-time and low computing power performance requirements of vehicle communication and the high precision requirements of intrusion detection, on the basis of LSTM, this embodiment also introduces an attention mechanism and a Dropout mechanism to establish a light model. Among them, the Dropout layer is connected between the output of the LSTM layer and the input of the Dense layer; the attention mechanism layer is connected between the output of the Dense layer and the input of the output layer.

[0049] LSTM can learn the temporal characteristics of input data very well, and has a powerful effect in the field of classification and prediction. LSTM is an improvement on the traditional RNN (recurrent neural network) which has only one state h. In comparison, LSTM introduces an input gate, a forget gate, an output gate, and a cell state, which enables it to better handle long dependencies in sequences. The gate is actually a fully connected layer, whose input is a vector and whose output is a real number vector between 0 and 1. Then, the 0 and 1 vectors can be used to decide how much of the current input can be retained in the network. Figure 4 As shown, the LSTM framework includes:

[0050] Forget Gate:

[0051] The forget gate controls the previous state C t-1 Which information is discarded, through x t and h t-1 The operation is performed, and after the σ function is calculated, a vector of 0 or 1 is obtained. 0 means that a part of the previous memory needs to be forgotten, and 1 means that a part of the memory needs to be retained. The formula is as follows:

[0052] f t =σ(W f ·[h t-1 ,x t ]+b f );

[0053] Input Gate:

[0054] The input gate determines what new information is stored in the current state, that is, by adding the information that needs to be retained before and the information that needs to be remembered now, a new memory state is obtained. Therefore, information is updated under the joint action of the input gate and the forget gate. The formula of the input gate is as follows:

[0055]

[0056] Cell status update:

[0057] Update the cell state according to the calculation results of the input gate and the forget gate. The formula is as follows:

[0058]

[0059] Output Gate:

[0060] Integration C t Get an output where C t represents the required memory, but the actual output is h t , the formula is as follows:

[0061] o t =σ(W o ·[h t-1 ,x t ]+b o )

[0062] h t =o t ×tan(C t )

[0063] In the above formula, the parameters that LSTM needs to learn are 4 sets of weight matrices and 4 sets of biases, which are W f ,W i ,W c ,W o ,b f ,b i ,b c ,b o σ represents the sigmoid function, tan represents the tanh function, and the corresponding formulas are as follows:

[0064]

[0065] Here, z represents the independent variable.

[0066] Normal neural networks need to fully learn and train each node during learning. However, after using Dropout, some neural units will be randomly removed from the network.

[0067] This makes the remaining network more streamlined. Therefore, this embodiment introduces Dropout on the basis of LSTM to simplify the model, prevent overfitting and enhance generalization performance.

[0068] Furthermore, the attention mechanism is a data processing method in machine learning. The degree of attention paid to different information in the network is determined by weights, which can be regarded as a multi-layer perceptron composed of query matrix, key and weighted average. Its formula is as follows:

[0069]

[0070] Among them, Querry represents a given Target element, and Source is a series of<Key,Value> Key-value pair, Lx=||Source|| represents the length of Source, and Similarity is the weight coefficient.

[0071] Specifically, Figure 1 As shown, the CAN message data (Dataset) with time series characteristics is input through the input layer. The length of a CAN message is 45 bits. A time window is selected, so the tensor input to the LSTM layer is (n, 45). The Dropout mechanism is used after the LSTM layer to prevent overfitting. It can discard some units with a certain probability, so when the Dropout is executed, a thin network will be obtained. Then add a Dense (dense base layer, also known as a fully connected layer) to summarize the output. In addition, an attention mechanism is added before the output layer, so that the attention value can be calculated during the training process and the network parameters can be updated. Finally, the detection model of this embodiment can obtain multiple numbers tending to 0 or tending to 1 through the output layer. The detection model of this embodiment combines LSTM, Dropout and attention mechanisms to achieve feature extraction of sequential text data while avoiding the problems of overfitting and network time-consuming.

[0072] After the model is built, the detection model is trained and tested using the CAN message data set. Typically, the data set is divided into 80% for training to optimize the model and 20% for testing to verify the detection performance of the model.

[0073] Finally, in step S4 of this embodiment, the real-time collected CAN message is input into the trained detection model to perform CAN network intrusion detection, and the detection result is processed to warn the user. Among them, the detection result output by the detection model of this embodiment is a number between 0 and 1, tending to 0 or tending to 1, so in this embodiment, the detection result with a number less than a preset value (set to 0.5 in this embodiment, which can be flexibly set according to the actual situation during specific implementation) is uniformly recorded as 0, and the detection result with a number greater than or equal to the preset value is uniformly recorded as 1; consistent with the label of the data set, 1 means normal, and 0 means being attacked by the network. At the same time, in order to avoid false alarms, this embodiment also counts the occurrence of the number 0, that is, whenever the detection result is 0, the counter is increased by one, and when the counter reaches the preset threshold (which can be flexibly set according to the actual situation during specific implementation), the user is warned and the abnormal log is uploaded to the security operation cloud platform (VSOC).

[0074] At the same time, according to the above-mentioned LSTM-based vehicle-mounted CAN network intrusion detection method, this embodiment also proposes an LSTM-based vehicle-mounted CAN network intrusion detection system, the system includes a data acquisition module, an LSTM detection module, and a detection result processing module, wherein the data acquisition module is used to collect CAN messages in vehicle-mounted communications in real time and send them to the LSTM detection module after processing; the LSTM detection module is used to perform intrusion detection on CAN messages through a trained detection model; the detection result processing module is used to identify the output result of the LSTM detection module and after identifying network intrusion, warn the user and report the abnormal log to the security operation cloud platform.

[0075] The in-vehicle CAN network is a bus-structured network with a central gateway as the core node, which aggregates and routes CAN data from each control domain. Therefore, in this embodiment, the system is integrated into the in-vehicle central gateway.

[0076] Specifically, the data acquisition module of this embodiment includes an OBD adapter, a PCAN cable, and a PCANView host computer, wherein one end of the OBD adapter is connected to the vehicle-mounted OBD (vehicle self-diagnosis system), and the other end is connected to the serial port end of the PCAN cable; the USB end of the PCAN cable is connected to the PCANView host computer; the PCANView host computer is used to collect and process CAN messages in vehicle communication through the vehicle-mounted OBD, and at the same time, it is also used to simulate network attack messages for detection model training. When performing model training, the PCANView host computer uses PCANView to record normal data packets of the vehicle-mounted CAN, and can also use PCANView to simulate sending attack messages while recording complete data packets containing attacks for model training. However, PCANView cannot implement some attack forms, such as Fuzz attacks, so it can also be recorded with the help of mature SocketCAN interface development script tools.

[0077] In order to prove that the model of the present invention has a good detection effect, the public data set Car-Hacking Dataset of the Korean Attack and Countermeasure Laboratory is used for verification. This data set uses two Raspberry Pis to access the OBD-II interface of the Hyundai YF Santana, one for sending data and the other for receiving data. It contains a normal data set, a DoS attack data set, a Fuzz attack data set, and an RPM and GEAR deception attack data set. The data details are shown in Table 1.

[0078]

[0079] Table 1

[0080] In order to simulate the restricted environment of the vehicle, the device used in the experiment is a laptop with weak performance, and GPU acceleration is not used in the experiment. The computer CPU configuration is Intel i7-1165G7, and the memory size is 16G. The performance of the model is evaluated using precision (Precision), false negative rate (FNR), error rate (ER), recall rate (Recall) and F1 score (F1 Score). The above indicators are calculated using the confusion matrix, and the matrix indicators are as follows:

[0081] True Positive (TP): Correctly classified attack data.

[0082] True Negative (TN): Correctly classified normal data.

[0083] False Positive (FP): Misclassified attack data.

[0084] False Negative (FN): Normal data that is misclassified.

[0085] The precision, missed detection rate, error rate, recall rate and F1 score indicators are calculated based on the above confusion matrix using the following five formulas:

[0086]

[0087] Recall = 1-FNR;

[0088]

[0089] The hyperparameters used are shown in Table 2.

[0090]

[0091] Table 2

[0092] Finally, the confusion matrix is ​​obtained as Figure 5 As shown. Combined Figure 5 The precision, missed detection rate, error rate, recall rate and F1 score indicators with six decimal places are shown in Table 3. It can be seen that the model has achieved 100% accuracy in the detection of DoS attacks, because DoS attacks are characterized by low ID and high frequency. In the remaining Fuzz, Gear and Rpm deception attacks, relatively good results are obtained, with an accuracy of more than 99%.

[0093] type Accuracy Missed detection rate Error rate Recall Fl DoS 1.00 0 0 1.00 1.00 Fuzz 0.997025 0.004089 0.004220 0.995911 0.996468 Gear 0.999748 0.000487 0.000099 0.999513 0.999630 Rpm 0.999294 0.000537 0.0001 75 0.999463 0.999379

[0094] Table 3

[0095] The present invention is described above by way of example in conjunction with the accompanying drawings. Obviously, the specific implementation of the present invention is not limited to the above-mentioned methods. As long as various non-substantial improvements are made using the method concept and technical solution of the present invention; or the above concept and technical solution of the present invention are directly applied to other occasions without improvement, they are all within the protection scope of the present invention.

Claims

1. A vehicle-mounted CAN network intrusion detection method based on LSTM, characterized by: The method comprises the following steps: Step S1, constructing a CAN message data set with timing characteristics; Step S2: construct a CAN network intrusion detection model based on LSTM; Step S3, applying the CAN message data set to the training and testing of the detection model; Step S4: Use the trained detection model to perform CAN network intrusion detection, and process the detection results to warn the user.

2. According to the LSTM-based vehicle-mounted CAN network intrusion detection method according to claim 1, it is characterized in that: The step S1 comprises: Step S11, collecting CAN messages in the historical vehicle communication process and removing redundancy; Step S12: Record the arrival timestamp of the message, and calculate the time difference between it and the previous message if the ID is the same; Step S13, combining the time difference with the corresponding ID and performing binarization processing to obtain a corresponding binary string; Step S14: label and classify the binary strings, wherein a normal binary string is marked as 1, and an abnormal binary string, that is, a binary string that is attacked by a network, is marked as 0; and so on, ultimately forming a CAN message data set with timing characteristics.

3. According to the LSTM-based vehicle-mounted CAN network intrusion detection method of claim 1, it is characterized in that: In step S2, the detection model includes an input layer, an LSTM layer, a Dense layer, and an output layer which are connected in sequence.

4. According to the LSTM-based vehicle-mounted CAN network intrusion detection method of claim 3, it is characterized in that: The detection model also includes a Dropout layer, wherein the Dropout layer is connected between the output of the LSTM layer and the input of the Dense layer.

5. A vehicle-mounted CAN network intrusion detection method based on LSTM according to claim 3 or 4, characterized in that: The detection model also includes an attention mechanism layer, wherein the attention mechanism layer is connected between the output of the Dense layer and the input of the output layer.

6. The LSTM-based vehicle-mounted CAN network intrusion detection method according to claim 2 is characterized in that: In step S4, the detection result output by the detection model is a number between 0 and 1, wherein the detection result with a number less than a preset value is uniformly recorded as 0, and the detection result with a number greater than or equal to the preset value is uniformly recorded as 1; consistent with the label of the data set, 1 indicates normal, and 0 indicates a network attack.

7. The LSTM-based vehicle CAN network intrusion detection method according to claim 6 is characterized in that: In step S4, the occurrence of the number 0 is also counted. Whenever the detection result is 0, the counter is incremented by one. When the counter reaches a preset threshold, an alarm is issued to the user.

8. An LSTM-based vehicle CAN network intrusion detection system according to any one of claims 1 to 7, characterized in that: The system includes a data acquisition module, an LSTM detection module, and a detection result processing module, wherein the data acquisition module is used to collect CAN messages in vehicle-mounted communications in real time and send them to the LSTM detection module after processing; the LSTM detection module is used to perform intrusion detection on CAN messages through a trained detection model; the detection result processing module is used to identify the output results of the LSTM detection module and, after identifying network intrusion, warn the user and report the abnormal log to the security operation cloud platform.

9. The LSTM-based vehicle-mounted CAN network intrusion detection system according to claim 8, characterized in that: The system is integrated into the vehicle's central gateway.

10. The LSTM-based vehicle-mounted CAN network intrusion detection system according to claim 8, characterized in that: The data acquisition module includes an OBD adapter, a PCAN connection line, and a PCANView host computer, wherein one end of the OBD adapter is connected to the vehicle-mounted OBD, and the other end is connected to the PCAN The serial port end of the connecting line is connected; the USB end of the PCAN connecting line is connected to the PCANView host computer; The PCANView host computer is used to collect and process CAN messages in vehicle communication through the vehicle OBD. At the same time, it is also used to simulate network attack messages for detection model training.

Images