A method for detecting abnormal traffic in Internet of Vehicles based on CNN+TCN+Attention mechanism

Abstract

The present invention discloses a method for detecting abnormal traffic in the Internet of Vehicles based on the CNN+TCN+Attention mechanism, which belongs to the technical field of abnormal traffic detection in the Internet of Vehicles. S1: preprocessing the CAN bus data set, and adjusting the data sets with different feature types into a time series matrix suitable for model input through preprocessing; S2: inputting the time series matrix of S1 into the CNN+TCN+Attention model framework to obtain a weighted feature representation of the input sequence, and inputting it into the subsequent classification layer; S3: training two classifiers to perform aggressive detection of network traffic and identify the specific type of malicious traffic. The present invention combines the local feature extraction capability of CNN, the long-term and short-term dependency modeling advantages of TCN, and the ability of the Attention mechanism to focus on key features, and can capture more comprehensive and detailed Internet of Vehicles traffic features, thereby significantly improving the accuracy and robustness of detection, effectively reducing the false alarm rate, and enhancing the real-time response capability and reliability of the system.

Description

Technical Field

[0001] The present invention relates to the field of abnormal traffic detection in Internet of Vehicles (IoV), and in particular to an IoV abnormal traffic detection method based on the CNN+TCN+Attention mechanism. Background Art

[0002] With the rapid development of connected vehicle (IoV) technology, vehicle information systems are becoming increasingly complex, the amount of data transmitted within the network has increased significantly, and data security issues are becoming increasingly serious. The diverse control systems and communication modules involved in the IoV have led to a more diverse network structure. In particular, in-vehicle network protocols (such as the CAN bus protocol) are widely used and lack basic security protection mechanisms, making them easy targets for attackers. Traditional security measures are unable to meet the security requirements of dynamic and complex network environments, necessitating the development of technologies that can effectively detect abnormal traffic in real time.

[0003] In recent years, with the continuous advancement of IoV traffic detection technology, methods for detecting abnormal CAN bus traffic have also made significant progress. Traditionally, abnormal traffic detection has relied primarily on rule-based and statistical methods, which identify anomalous data by setting thresholds or leveraging statistical features. However, due to the lack of built-in security mechanisms in the IoV CAN bus protocol, purely rule-based detection is prone to missed detections and false positives when faced with complex and diverse attacks. Furthermore, statistical methods lack adaptability to dynamically changing network environments and struggle to meet real-time requirements. With the rapid development of deep learning technology, detection methods based on machine learning and deep learning have gradually become mainstream. For example, traditional machine learning algorithms such as support vector machines (SVM) and random forests (RF) have been applied to identify abnormal patterns in CAN data, but their reliance on manual feature extraction has limited effectiveness.

[0004] Based on the above defects, a method for detecting abnormal traffic in Internet of Vehicles based on CNN+TCN+Attention mechanism is proposed. Summary of the Invention

[0005] The purpose of the present invention is to provide a method for detecting abnormal traffic in the Internet of Vehicles based on the CNN+TCN+Attention mechanism to solve the problems in the background technology.

[0006] To achieve the above objectives, the present invention provides a method for detecting abnormal traffic in Internet of Vehicles based on the CNN+TCN+Attention mechanism, comprising the following steps:

[0007] S1. Preprocess the CAN bus data set and adjust the data sets with different feature types into a time series matrix suitable for model input through preprocessing to ensure the consistency of the data input to the model;

[0008] S2: Input the time series matrix of S1 into the CNN+TCN+Attention model framework to obtain the weighted feature representation of the input sequence, which is then input into the subsequent classification layer.

[0009] S3, obtain the global feature representation of the entire time series from S2, and then train two classifiers to detect the aggressiveness of network traffic and identify the specific type of malicious traffic.

[0010] Preferably, in said S1, the preprocessing includes data loading and basic inspection, time series division and feature encoding and standardization.

[0011] Preferably, the specific steps of the data loading and basic inspection are: merging different types of abnormal traffic data sets in the CAN data set, and dividing the entire data set into two categories: normal traffic and abnormal traffic; among them, 80% of the normal traffic and abnormal traffic data are used for the training set, and 20% are used for the test set; deleting samples with content fields less than 64 bits in the traffic data to ensure the consistency of the input data.

[0012] Preferably, the specific steps of the time series division are: determining the sliding window size, and dividing the original data into sequences of fixed length.

[0013] Preferably, the specific steps of the feature encoding and standardization are: label encoding the traffic type in the data set, converting the hexadecimal character field of the data frame content field in each time step into binary according to the time step, and standardizing the numerical features in the data set, and the output numerical features are:

[0014]

[0015] Among them, X is the original eigenvalue, μ is the current sample mean, σ is the standard deviation, X standardized Represents the normalized value.

[0016] Preferably, the specific steps of S2 are:

[0017] After receiving the time series matrix, the S21 CNN layer performs two convolution and pooling operations to reduce the time step and feature dimension, and outputs a multi-channel feature map. All multi-channel feature maps together constitute the output feature;

[0018] The S22 and TCN layers accept multi-channel feature maps and, through two dilated convolutional layers, expand the receptive field without increasing computational effort, capturing dependencies over longer time spans. Through the TCN layers, the model can learn global temporal patterns in IoV traffic data, providing more accurate temporal feature representations for anomaly detection tasks.

[0019] S23, the Attention layer maps the input tensor into three vectors: Query, Key, and Value vectors. It calculates similarity using the dot product of the Query and Key vectors, generates Attention weights from the similarity values using the softmax function, and uses the Attention weights to perform a weighted summation on the Value vector to obtain a weighted feature representation, allowing the model to focus on the more important parts of the sequence.

[0020] Preferably, in S22, the receptive field determines the range that the model can "see" in the input data. The dilated convolution of TCN expands the receptive field by introducing a dilation factor d. For each layer of dilated convolution, the receptive field formula is:

[0021] ReceptiveField=1+(k-1)·d;

[0022] Among them, k is the size of the convolution kernel, and d is the expansion factor;

[0023] The key to dilated convolution is d, which determines the span of the convolution kernel's jump on the input data. Dilated convolution can expand the receptive field without increasing the amount of computation by inserting intervals (determined by d) between the convolution kernel elements, thereby capturing long-term dependencies. The formula for dilated convolution is:

[0024]

[0025] Where y[t] is the eigenvalue obtained by the convolution operation, l is the element index in the convolution kernel, x[td·l] is the value of the [td·l]th position of the input sequence, and w[l] is the convolution kernel weight;

[0026] By adjusting the dilation factor d, the convolution kernel can jump to different positions in the input sequence. This jumpy access pattern preserves the temporal order of the data while expanding the receptive field, capturing long-term dependencies with less computation. The 3D feature tensor output by the TCN layer enters the subsequent Attention mechanism, which further processes this output to extract key time series features for classification tasks.

[0027] In S23, the similarity is expressed as:

[0028]

[0029] Where Q is the Query matrix, k T is the transpose of the Key matrix, d k It is the dimension of Key, and the similarity value is converted into a weight matrix through the softmax function.

[0030] Preferably, the two classifiers trained in S3 are Sigmoid classifier and Softmax classifier; the specific steps are as follows:

[0031] S31, use the sigmoid activation function to output the probability value y predicted as the attack type ∧ , if y ∧ >0.5, it is predicted to be abnormal traffic. If y ∧ <0.5, the prediction is normal traffic;

[0032] S32. If the traffic is judged to be normal, the output is normal; if the traffic is judged to be abnormal, the model first performs a linear transformation on the feature vector output by the Attention layer, calculates a linear combination for each category i, and obtains the score Z for each category. i ;

[0033] S33, score Z is activated by Softmax function i Convert it into a probability distribution; the training model makes decisions based on the obtained probability distribution and selects the abnormal type with the highest probability as the final classification result.

[0034] Preferably, the probability value y ∧ The calculation formula is:

[0035]

[0036] Among them, y ∧ is the output of Sigmoid; h attention is the feature vector output by the Attention layer; W is the weight matrix; b is the scalar bias term;

[0037] The loss function uses BCE LOSS, and the formula is as follows:

[0038] BCELOSS=-(ylog(y ∧ )+(1-y)log(1-y ∧ ));

[0039] Among them, y is the true label of the current traffic;

[0040] Score Z i The calculation formula is:

[0041] Zi =w i ·h attention +b i ;

[0042] Among them, w i is the weight vector defined by the Softmax classifier for the i-th type of anomaly, b i is the bias term for the i-th type of anomaly.

[0043] Preferably, in S33, the calculation formula of the probability distribution is:

[0044]

[0045] Where n is the total number of attack categories, j is the index of a category among all attack categories, and P i is the probability that the input traffic belongs to the i-th category of anomaly; the Softmax classifier converts the score of each category into a probability between 0 and 1, ensuring that the sum of all category probabilities is 1;

[0046] The Softmax classifier uses the Categorical Cross-Entropy loss function to measure the difference, and its formula is:

[0047] Loss=-∑ i y i log(p i );

[0048] Among them, y i is the one-hot encoding of the actual category, p i It is the predicted probability of the corresponding category. The trained model makes decisions based on the probability distribution P output by the Softmax classifier and selects the abnormal type with the highest probability as the final classification result.

[0049] Therefore, the present invention provides a method for detecting abnormal traffic in Internet of Vehicles based on the CNN+TCN+Attention mechanism, which has the following beneficial effects:

[0050] (1) The present invention combines the local feature extraction capability of CNN, the long-term and short-term dependency modeling advantages of TCN, and the ability of the Attention mechanism to focus on key features to construct an IoV abnormal traffic detection model with efficient feature extraction and important feature selection. In future actual deployments, the model can be deployed in different locations according to the system's computing resources and real-time requirements. For scenarios with high real-time requirements, the optimized model can be deployed on the ECU or the vehicle gateway. For systems with greater computing power and collaborative detection requirements, it can be deployed on edge devices or the cloud to achieve a wider range of security detection and response.

[0051] (2) The CNN+TCN+Attention model has multi-layer feature extraction capabilities. The model extracts multiple features of the data through a hierarchical structure, making the detection effect more comprehensive and accurate. This structure can effectively capture long-term dependencies while maintaining real-time performance. The dilated convolution of TCN not only captures dependencies across long time steps, but also has the characteristics of parallel computing, significantly improving the processing efficiency of the model. Compared with traditional recurrent neural networks, this parallel processing capability enables the model to perform well in real-time detection and quickly respond to and detect abnormal traffic in the Internet of Vehicles.

[0052] (3) The Attention mechanism provides the model with the ability to focus on data features, enabling the model to assign higher weights to abnormal behavior features, improve the robustness and accuracy of detection, reduce attention to irrelevant information, and effectively reduce the false alarm rate.

[0053] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A framework diagram of an embodiment of the present invention;

[0055] Figure 2 This is a detection flow chart of an embodiment of the present invention. DETAILED DESCRIPTION

[0056] The technical solution of the present invention is further described below with reference to the accompanying drawings and embodiments.

[0057] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0058] Example

[0059] like Figure 1-Figure 2 As shown, the present invention provides a method for detecting abnormal traffic in the Internet of Vehicles based on the CNN+TCN+Attention mechanism, comprising the following steps:

[0060] S1. Preprocess the CAN bus data set and adjust the data sets with different feature types into a time series matrix suitable for model input through preprocessing to ensure the consistency of the data input to the model. Specifically:

[0061] 1) Data loading and basic checks: The different types of abnormal traffic data sets in the CAN dataset are merged and the entire dataset is divided into two categories: normal traffic and abnormal traffic. 80% of the normal traffic and abnormal traffic data are used for the training set, and the remaining 20% are used for the test set. Samples with content fields less than 64 bits in the traffic data are deleted to ensure the consistency of the input data.

[0062] 2) Time series partitioning: Determine the sliding window size and divide the original data into sequences of fixed length; the sliding window is N = 50 and D = 8. Each group of data sent to the CNN network contains 50 time steps, and each time step has 8 features.

[0063] 3) The specific steps of feature encoding and standardization are as follows: label the traffic types in the dataset. Taking one-hot encoding as an example, normal traffic is encoded as [1, 0, 0, 0, 0], abnormal traffic is encoded as [0, 1, 0, 0, 0], attack type A is encoded as [0, 0, 1, 0, 0], attack type B is encoded as [0, 0, 0, 1, 0], and attack type C is encoded as [0, 0, 0, 0, 1].

[0064] According to the time step, the hexadecimal character field of the data frame content field in each time step is converted to binary and the numerical features in the dataset are standardized. The output numerical features are:

[0065]

[0066] Among them, X is the original eigenvalue, μ is the current sample mean, σ is the standard deviation, X standardized Represents the normalized value.

[0067] S2: Input the time series matrix of S1 into the CNN+TCN+Attention model framework to obtain the weighted feature representation of the input sequence, which is then input into the subsequent classification layer.

[0068] The configuration parameters of each module are as follows:

[0069]

[0070] The specific operations are as follows:

[0071] After the S21 and CNN layers receive the time series matrix, they perform two convolution and pooling operations to reduce the time step and feature dimension, and output a multi-channel feature map of size 12×2×64, where the number of channels is 64 and the size of each channel is a 12×2 feature map. All multi-channel feature maps together constitute the output feature.

[0072] The S22 and TCN layers accept a multi-channel feature map with an input size of 12×2×64. Two dilated convolutional layers expand the receptive field without increasing the computational effort, allowing the model to capture dependencies over longer time spans. Compared to traditional recurrent neural networks (such as RNNs and LSTMs), TCN's parallel computing capabilities significantly improve processing efficiency while avoiding the gradient vanishing or gradient exploding issues in modeling long-term dependencies. Through the TCN layer, the model can learn global temporal patterns in IoV traffic data, providing more accurate temporal feature representations for anomaly detection tasks.

[0073] The receptive field determines the range of what the model can "see" in the input data. The dilated convolution of TCN expands the receptive field by introducing a dilation factor d. For each layer of dilated convolution, the receptive field formula is:

[0074] ReceptiveField=1+(k-1)·d;

[0075] Where k is the size of the convolution kernel and d is the dilation factor. The key to dilated convolution is d, which determines the span of the convolution kernel jumps on the input data. Dilated convolution can expand the receptive field without increasing the amount of computation by inserting intervals (determined by d) between the convolution kernel elements, thereby capturing long-term dependencies. The formula for dilated convolution is:

[0076]

[0077] Where y[t] is the eigenvalue obtained by the convolution operation, l is the element index in the convolution kernel, x[td·l] is the value of the [td·l]th position of the input sequence, and w[l] is the convolution kernel weight;

[0078] By adjusting the dilation factor d, the convolution kernel can jump to different positions in the input sequence. This jumpy access pattern preserves the temporal order of the data while expanding the receptive field, capturing long-term dependencies with less computation. The TCN layer outputs a 12×2×64 3D feature tensor that enters the subsequent Attention mechanism. The Attention layer further processes this output to extract key time series features for classification tasks.

[0079] S23, the Attention layer maps the input tensor into three vectors, namely the Query, Key, and Value vectors. The similarity is calculated using the dot product of the Query and Key vectors, and the Attention weight is generated from the similarity value through the softmax function. The similarity is expressed as:

[0080]

[0081] Where Q is the Query matrix, k T is the transpose of the Key matrix, d k The similarity matrix is the dimension of the key. The softmax function is used to convert the similarity value into a weight matrix. The attention weight is used to perform a weighted summation on the value vector to obtain a weighted feature representation, allowing the model to focus on the more important parts of the sequence.

[0082] S3, obtains the global feature representation of the entire time series from S2, and then trains two classifiers, the Sigmoid classifier and the Softmax classifier, to detect the aggressiveness of network traffic and identify the specific type of malicious traffic; the details are as follows:

[0083] S31, use the sigmoid activation function to output the probability value y predicted as the attack type ∧ ,

[0084] The calculation formula is:

[0085]

[0086] Among them, y ∧ is the output of Sigmoid; h attention is the feature vector output by the Attention layer; W is the weight matrix; b is the scalar bias term; if y ∧ >0.5, it is predicted to be abnormal traffic. If y ∧ <0.5, it is predicted as normal traffic; the loss function uses BCE LOSS, the formula is as follows:

[0087] BCELOSS=-(ylog(y ∧ )+(1-y)log(1-y ∧ ));

[0088] Among them, y is the true label of the current traffic;

[0089] S32. If the traffic is judged to be normal, the output is normal; if the traffic is judged to be abnormal, the model first performs a linear transformation on the feature vector output by the Attention layer, calculates a linear combination for each category i, and obtains the score Z for each category. i ;

[0090] Z i =w i ·h attention +b i ;

[0091] Among them, w i is the weight vector defined by the Softmax classifier for the i-th type of anomaly, b iis the bias term for the i-th type of anomaly.

[0092] S33, score Z is activated by Softmax function i Converted to probability distribution, the calculation formula of probability distribution is:

[0093]

[0094] Where n is the total number of attack categories, j is the index of a category among all attack categories, and P i is the probability that the input traffic belongs to the i-th category anomaly; the Softmax classifier converts the score of each category into a probability between 0 and 1, ensuring that the sum of all category probabilities is 1.

[0095] The Softmax classifier uses the Categorical Cross-Entropy loss function to measure the difference, and its formula is:

[0096] Loss=-∑ i y i log(p i );

[0097] Among them, y i is the one-hot encoding of the actual category, p i It is the predicted probability of the corresponding category. The trained model makes decisions based on the probability distribution P output by the Softmax classifier and selects the abnormal type with the highest probability as the final classification result.

[0098] Therefore, the present invention proposes a method for detecting abnormal traffic in the Internet of Vehicles based on the CNN+TCN+Attention mechanism, which combines the local feature extraction capability of CNN, the long-term and short-term dependency modeling advantages of TCN, and the ability of the Attention mechanism to focus on key features. It can capture more comprehensive and detailed Internet of Vehicles traffic characteristics, thereby significantly improving the accuracy and robustness of detection, effectively reducing the false alarm rate, and enhancing the real-time response capability and reliability of the system.

[0099] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit the same. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solutions of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for detecting abnormal traffic in Internet of Vehicles based on CNN+TCN+Attention mechanism, characterized by: The following steps are involved: S1. Preprocess the CAN bus data set and adjust the data sets with different feature types into a time series matrix suitable for model input through preprocessing to ensure the consistency of the data input to the model; S2: Input the time series matrix of S1 into the CNN+TCN+Attention model framework to obtain the weighted feature representation of the input sequence, which is then input into the subsequent classification layer. The specific steps are as follows: After receiving the time series matrix, the S21 CNN layer performs two convolution and pooling operations to reduce the time step and feature dimension, and outputs a multi-channel feature map; The S22 and TCN layers accept all multi-channel feature maps and, after two dilated convolutional layers, expand the receptive field without increasing the amount of computation, capturing dependencies over longer time spans. The receptive field formula is: ； in, is the size of the convolution kernel, is the expansion factor; The formula for dilated convolution is: ； in, is the eigenvalue obtained by convolution operation, is the element index in the convolution kernel, is the first The value of the position, is the convolution kernel weight, by adjusting the expansion factor , the convolution kernel implements jump access to different positions of the input sequence; S23, the Attention layer maps the input tensor into three vectors: Query, Key, and Value. It calculates similarity using the dot product of the Query and Key vectors, generates Attention weights from the similarity values using the softmax function, and then performs a weighted summation of the Value vector using the Attention weights to obtain a weighted feature representation, allowing the model to focus on the more important parts of the sequence. The similarity is expressed as: ； in, is the Query matrix, is the transpose of the Key matrix, is the dimension of the Key; S3, obtain the global feature representation of the entire time series from S2, and then train two classifiers to detect the aggressiveness of network traffic and identify the specific type of malicious traffic.

2. The method for detecting abnormal traffic in the Internet of Vehicles based on the CNN+TCN+Attention mechanism according to claim 1 is characterized by: In S1, the preprocessing includes data loading and basic inspection, time series division, and feature encoding and standardization.

3. The method for detecting abnormal traffic in Internet of Vehicles based on CNN+TCN+Attention mechanism according to claim 2 is characterized in that: The specific steps of data loading and basic inspection are as follows: merging different types of abnormal traffic data sets in the CAN data set, and dividing the entire data set into two categories: normal traffic and abnormal traffic; deleting samples with content fields less than 64 bits in the traffic data to ensure the consistency of the input data.

4. The method for detecting abnormal traffic in the Internet of Vehicles based on the CNN+TCN+Attention mechanism according to claim 3 is characterized by: The specific steps of the time series division are: determining the sliding window size and dividing the original data into sequences of fixed length.

5. The method for detecting abnormal traffic in Internet of Vehicles based on CNN+TCN+Attention mechanism according to claim 2 is characterized in that: The specific steps of feature encoding and standardization are: label encoding the traffic type in the data set, converting the hexadecimal character field of the data frame content field in each time step into binary according to the time step, and standardizing the numerical features in the data set. The output numerical features are: ； in, is the original eigenvalue, is the current sample mean, is the standard deviation, Represents the normalized value.

6. The method for detecting abnormal traffic in Internet of Vehicles based on CNN+TCN+Attention mechanism according to claim 1 is characterized by: The two classifiers trained in S3 are Sigmoid classifier and Softmax classifier; the specific steps are as follows: S31, using the sigmoid activation function to output the probability value predicted as the attack type ,like , then it is predicted to be abnormal traffic. If , the prediction is normal traffic; S32. If the flow rate is determined to be normal, the output is normal; If the traffic is judged to be abnormal, the model first performs a linear transformation on the feature vector output by the Attention layer. Calculate a linear combination to get the score of each category ; S33, score through Softmax activation function Convert it into a probability distribution; the training model makes decisions based on the obtained probability distribution and selects the abnormal type with the highest probability as the final classification result.

7. The method for detecting abnormal traffic in Internet of Vehicles based on CNN+TCN+Attention mechanism according to claim 6 is characterized by: The probability value The calculation formula is: ； in, is the output of Sigmoid; is the feature vector output by the Attention layer; is the weight matrix; is a scalar bias term; Score The calculation formula is: ； in, The Softmax classifier is The weight vector defined by the class anomaly, It is Bias term for class anomalies.

8. The method for detecting abnormal traffic in Internet of Vehicles based on CNN+TCN+Attention mechanism according to claim 7 is characterized in that: In S33, the calculation formula of the probability distribution is: ； in, is the total number of attack categories, is a category index among all attack categories, Is the input flow belongs to The Softmax classifier converts the score of each category into a probability between 0 and 1, ensuring that the sum of all category probabilities is 1.

Images