Lightweight vehicle-mounted network intrusion detection system based on DBC file and voltage signal

Abstract

The invention discloses a lightweight vehicle-mounted network intrusion detection system based on a DBC file and a voltage signal, and belongs to the field of vehicle communication network security. According to the system, five different types of CAN messages and ID value ranges of the five different types of CAN messages are mapped by analyzing a vehicle-mounted DBC file, so that five MobileNet neural network sub-models are constructed, and attack behaviors aiming at different types of messages are identified. The implementation of the system comprises the steps of DBC file analysis, signal sampling, data preprocessing, feature extraction and model building and training. And finally, comprehensive testing is carried out in a prototype network comprising five CAN devices. Test results show that compared with a traditional vehicle-mounted network intrusion detection system, the vehicle-mounted network intrusion detection system has higher detection accuracy and shorter detection time. According to the lightweight intrusion detection system, the data processing speed and safety of a vehicle-mounted system are effectively improved, and safe operation of a vehicle-mounted network in a complex environment is ensured.

Description

Technical Field

[0001] The invention belongs to the field of vehicle communication network security and relates to a lightweight vehicle-mounted network intrusion detection system based on DBC files and voltage signals. Background Art

[0002] As a key technology for connecting various on-board electronic control units (ECUs), the security of the vehicle controller area network directly affects the operational safety and data privacy protection of the vehicle. However, since the traditional CAN network was not designed with security in mind, it lacks effective authentication and data confidentiality mechanisms and is vulnerable to security threats. As vehicles interact more frequently with the Internet, other vehicles, and roadside infrastructure, this security vulnerability is particularly prominent, increasing the possibility of vehicle systems being attacked.

[0003] In order to effectively detect attacks on vehicle networks, a large number of researchers have designed a variety of vehicle network intrusion detection systems (IDS), which are mainly divided into two categories: IDS based on CAN data packets and IDS based on ECU hardware features. IDS based on CAN data packets mainly studies periodic CAN data and lacks effective processing for non-periodic frames; IDS based on ECU hardware requires a lot of computing resources, which limits their practicality in vehicle systems. In addition, these systems usually require a lot of storage space and processing power, which increases the cost and complexity of vehicle systems. Therefore, it is particularly important to develop a lightweight, efficient and adaptive security detection system for various vehicle network environments.

[0004] The present invention proposes a lightweight vehicle network intrusion detection system based on DBC (Database CAN, DBC) file and voltage signal analysis. Each CAN ID and its corresponding message type in the CAN network are obtained by analyzing the DBC file, and a detection model based on CAN signal voltage is established for each type of message. Considering the high requirements of the vehicle network environment for real-time performance and computing efficiency, the model is implemented using a lightweight MobileNet neural network, so that the system achieves the best balance between detection speed and accuracy, and is suitable for automotive embedded systems. Summary of the invention

[0004] Based on the deficiencies of existing vehicle network security technology, the present invention discloses a lightweight vehicle network intrusion detection system based on DBC files and voltage signals, which is used to improve the security detection efficiency of vehicle networks, especially in the ability to identify network anomalies and potential threats in real time.

[0005] To achieve the above purpose, the vehicle network intrusion detection system disclosed in the present invention includes:

[0006] Parse the DBC file of the vehicle CAN network and obtain the CAN communication matrix.

[0007] According to the CAN communication matrix, different message types are combined with their corresponding CAN ID ranges to form a table of message types and CAN ID correspondences.

[0008] The ID value and differential voltage signal corresponding to each data frame on the CAN bus are collected, and the captured analog voltage signal is converted into a digital signal using a high-precision analog-to-digital converter (AD module).

[0009] The FPGA (model: Xilinx ZYNQ-7Z035) is used to calculate and store the characteristic value of each signal.

[0010] Based on the message type and ID value of each data frame, the messages are divided into five categories and modeled and trained respectively.

[0011] Detect the signals transmitted by the CAN bus in real time and issue an alarm for intrusion signals.

[0012] According to a lightweight vehicle-mounted network intrusion detection system based on a DBC file and a voltage signal provided by the present invention, the voltage signal mainly includes the RTR, Control, Data and CRC field voltages of a CAN data frame.

[0013] The five message types are: Periodic, On event, Ifactive, Periodic and on event, and Periodic and ifactive.

[0014] According to a lightweight vehicle network intrusion detection system based on DBC files and voltage signals provided by the present invention, the features are extracted using FPGA, and three modules of data acquisition, data processing and result transmission are constructed in FPGA:

[0015] Data acquisition module: obtains the voltage digital signal and its ID value collected by the AD module as the output of the module.

[0016] Data processing module: The output of the data acquisition module is used as the input of this module, the characteristic value of each input signal is calculated, and the calculation result is used as the output of the module.

[0017] Result transmission module: The output of the calculation data processing module is used as the input of this module and transmitted to the computer for model training.

[0018] Signal characteristic values ​​include: maximum, minimum, mean, mean deviation, skewness, kurtosis, root mean square, and centroid.

[0019] According to a lightweight vehicle network intrusion detection system based on DBC files and voltage signals provided by the present invention, the MobileNet model is one of the core components, which uses depthwise separable convolution to reduce the amount of calculation and model size.

[0020] Five sub-models are built, each specialized to process a specific type of message. These sub-models are consistent in their neural network structure but have specific training parameters tuned for the respective data type.

[0021] The output of the neural network is a classification decision that indicates whether the current network status is normal or there is a potential intrusion threat.

[0022] The 8 eigenvalues ​​output by the FPGA are used as the input of this model, and the eigenvalues ​​are reshaped into 2×4 dimensional data.

[0023] The first layer of the MobileNet model is a standard convolutional layer, using 32 3×3 convolution kernels, a stride of 1, and a "same" padding method to keep the spatial size of the output consistent with the input.

[0024] The depthwise separable convolution (DW convolution) block is used to process the output from the first layer. In this process, a convolution kernel is applied independently to each input channel.

[0025] The point-wise convolution (PW convolution) block takes the output of the depth-wise separable convolution as input and combines the feature channels from the depth-wise convolution to expand the width of the feature map.

[0026] The outputs of the DW convolution block and the PW convolution block are batch normalized and ReLU activated to maintain the nonlinearity of the network and the response activity of the model.

[0027] The Global Average Pooling (GAP) layer maps the output of the point-by-point convolutional layer to the feature vector, greatly reducing the model parameters and preventing overfitting.

[0028] The fully connected layer outputs the final prediction result.

[0029] The fully connected layer uses a softmax activation function to compute and output predictions.

[0030] The input data is inspected and the predicted ID values ​​are compared with the collected ID values.

[0031] If the predicted ID value matches the collected ID value, the CAN device corresponding to the ID value is considered to be a legitimate sender.

[0032] If the predicted ID value does not match the obtained ID value, the input data is placed into the sub-model corresponding to the predicted ID for further testing.

[0033] If the output ID value from another sub-model matches the actual ID value, the ECU corresponding to the ID value is considered to be from the CAN prototype and has been compromised.

[0034] Otherwise, the ECU corresponding to the ID value will be regarded as an external illegal malicious node.

[0035] In general, the present invention has the following beneficial effects:

[0036] 1. The system of the present invention effectively improves the security of vehicle networks through in-depth analysis of DBC files and real-time monitoring of voltage signals. The system can quickly and accurately identify and respond to various network anomalies and potential security threats, ensuring the driving safety of vehicles.

[0037] 2. The present invention uses a high-precision analog-to-digital converter FPGA to process voltage signals, combined with the MobileNet neural network, which significantly improves the detection speed and accuracy. This lightweight detection mode is very suitable for embedded systems and can maintain efficient operation while ensuring low resource consumption.

[0038] 3. The intrusion detection system of the present invention designs multiple sub-models for different CAN message types, and each model is specifically trained to adapt to its corresponding data type. This method improves the system's adaptability and detection accuracy against various types of attacks, making the system have better defense effects in the face of diverse communication modes and potential threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A schematic diagram of the detection process of a lightweight vehicle network intrusion detection system based on DBC files and voltage signals provided for the implementation of the present invention;

[0040] Figure 2 CAN network prototype diagram of a lightweight vehicle network intrusion detection system based on DBC files and voltage signals provided for the implementation of the present invention;

[0041] Figure 3 A data preprocessing flow chart of a lightweight vehicle network intrusion detection system based on DBC files and voltage signals provided for the implementation of the present invention;

[0042] Figure 4A data training schematic diagram of a lightweight vehicle network intrusion detection system based on DBC files and voltage signals provided for the implementation of the present invention. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described implementation examples are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] The core of the present invention is to provide a lightweight vehicle network intrusion detection system based on DBC files and voltage signals, which can analyze the voltage changes of the vehicle CAN network in real time, quickly identify and respond to potential security threats, so as to ensure the security of the vehicle network.

[0045] In order to enable those skilled in the art to better understand the solution of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0046] 101: Parse the DBC file of the vehicle CAN network and form a table corresponding to the message type and the CAN ID.

[0047] Use Vector CANdb++ Editor to parse DBC files obtained from vehicle original equipment manufacturers (OEMs). These DBC files contain detailed information about all messages in the vehicle CAN network, such as message identifiers (IDs), lengths, periodicity, signals, and their properties.

[0048] By parsing the obtained data, the communication matrix of the vehicle CAN network is obtained. This matrix records the name, ID, type, length and signals contained in each message in detail.

[0049] The acquired communication matrix is ​​further parsed, and a correspondence table between message type and CANID is created according to the information provided by the communication matrix to map the message type and CAN ID.

[0050] 102: Collect the ID value and differential voltage signal corresponding to each data frame on the CAN bus.

[0051] In this embodiment, the system uses a method combining an independent CAN controller MCP2515 CAN and an FPGA to capture the ID value of each message on the CAN bus.

[0052] Specifically, if Figure 2As shown, MCP2515 is connected to FPGA through SPI interface, and its working mode is set to monitoring mode so that it only receives messages without affecting the bus status.

[0053] When data transmission occurs on the CAN bus, the MCP2515 automatically stores the message in the receive buffer.

[0054] FPGA directly reads the ID of the received data frame from the receiving buffer of MCP2515 through the SPI interface and stores it in the set register.

[0055] In this embodiment, the system uses a dual-channel AD module (chip model: 3PA1030) combined with an FPGA to capture the differential voltage signal of each message on the CAN bus.

[0056] Specifically, Figure 2 As shown, in the constructed CAN prototype system, the CAN signal transceiver modules T1, T2, T3, T4 and T5 are connected to the AD module through the CAN_H and CAN_L wires.

[0057] On the CAN bus, the potential difference between the CAN_H and CAN_L lines is designed to represent the CAN signal. The potential difference on the CAN bus is divided into dominant level (logic 0) and recessive level (logic 1). When the CAN bus sends a recessive signal, the voltage of both lines is 2.5V. When sending a dominant signal, the CAN-H voltage rises to 3.5V, while the CAN-L voltage drops to 1.5V. The differential voltage range on the CAN bus is 0 to 2V.

[0058] Although the CAN-H and CAN-L signals can accurately distinguish between logic 0 and logic 1, these two signals will show certain fluctuations at the physical level, and these fluctuations usually reflect the characteristics of their source ECU. The interference of CAN-H and CAN-L usually occurs synchronously, and the differential signal can effectively offset this interference, thereby ensuring the stability and reliability of the signal. Therefore, this solution uses an AD module to collect the differential voltage signal of the CAN bus.

[0059] In practical applications, there is external noise that affects the measurement, and the measured differential voltage value may deviate from the theoretical range of 0 to 2 V. Therefore, the AD module used in this solution contains a voltage attenuation circuit that can accept a voltage between -5 and +5 V and attenuate it to 0 to 2 V.

[0060] Due to the arbitration mechanism of the CAN bus, multiple ECUs may try to send data at the same time, causing specific fields on the CAN bus, such as the confirmation field (ACK), to be affected by multiple ECUs. Therefore, this solution only focuses on the voltage signal from the remote transmission request (RTR) field to the cyclic redundancy check (CRC) field. This part of the signal is less subject to interference and is more suitable for extracting the unique characteristics of the ECU.

[0061] The AD module converts the analog voltage signal into a digital signal and stores it in the register of the FPGA.

[0062] 103: Calculate and extract the characteristic value of each voltage signal.

[0063] In order to effectively distinguish normal and abnormal data frames, the system needs to extract corresponding feature values ​​from the differential voltage signal of each CAN frame. These feature values ​​include maximum value, minimum value, average value, mean deviation, skewness, kurtosis, root mean square and centroid.

[0064] In this embodiment, the system uses FPGA to calculate and extract the characteristic value of each voltage signal.

[0065] Specifically, if Figure 3 As shown, three data preprocessing modules are set in FPGA.

[0066] The data acquisition module is used to obtain the voltage digital signal and its ID value collected by the AD module, and transmit it to the data processing module. The data processing module then calculates the characteristic value of each signal and transmits the calculation result to the result transmission module. The result transmission module transmits the characteristic value to the computer for model training.

[0067] Since the collected voltage values ​​and calculated characteristic values ​​are floating point numbers, and the floating point numbers are stored in the FPGA in the IEEE 754 format, we configured 2 input registers (register A and register B) and 7 output registers in the data processing module. Input register A is configured to directly receive the original voltage value obtained from the data acquisition part, and input register B is used to store the voltage data converted into the IEEE format.

[0068] Because floating-point numbers cannot be calculated directly in FPGA, we have integrated a dedicated floating-point operation IP core in the data processing module to perform various mathematical operations to calculate the required voltage characteristic values. These IP cores simplify the calculation process and improve development efficiency.

[0069] The calculated eigenvalues ​​are stored in seven output registers configured in the FPGA. These eigenvalues ​​are then fed into the neural network model for training and classification. After all the eigenvalues ​​are calculated, the system's transmission module sends these results to the connected computer for subsequent model building and analysis.

[0070] 104: Build MobileNet lightweight neural network models for various types of signals.

[0071] According to the information provided by the CAN communication matrix, the information transmitted on the CAN bus can be divided into five types. Based on this, we build five sub-models, each of which specializes in processing a specific type of message. These sub-models are consistent in their neural network structure, but have specific training parameters adjusted for their respective data types.

[0072] Specifically, the structure of the MobileNet model is as follows Figure 4 shown.

[0073] First, the input 8 eigenvalues ​​are reshaped into 2×4 dimensional data, and then the reshaped data is directly input into the neural network for a series of transformation and learning processes.

[0074] Create the first convolutional block of the model: X i Represents the input data of this layer, W (1) and b 1 Represent the weight and bias of the convolution layer respectively, and BN represents the batch normalization operation on the output of this layer to stabilize the learning process. This layer uses 32 3x3 convolution kernels, the step size is set to 1, and the 'same' padding is used to keep the spatial dimension of the output the same as the input. The ReLU activation function is applied to the batch normalized output to introduce nonlinearity and enhance the expressiveness of the model. The purpose of this layer is to extract the primary features of the input data.

[0075] Create a depthwise separable convolutional block: The depth-separable convolutional block converts the output of the previous layer As the input of this layer, the output after convolution The point-wise convolution block takes the output of the depth-wise separable convolution block As input, a convolution kernel is applied independently to each input channel, and the output Create another point-wise convolution block: W (2) 、b 2 and W (3) 、b 3Represent the weights and biases of the DW layer and PW layer respectively. The outputs of these two steps are also batch normalized and ReLU activated. The use of these two convolutional blocks increases the depth and complexity of the network, thereby improving the learning ability of the model.

[0076] Create an average pooling layer: The average pooling layer takes the output of the PW layer as input. GAP represents the global average pooling operation, which is output after this operation. This layer maps features into feature vectors, greatly reducing the number of parameters and helping to avoid overfitting. Establish a fully connected layer: The fully connected layer will As input, the softmax activation function is applied to the calculation result to output the prediction result

[0077] Define the loss function L: Where represents the actual ID value of the training data, represents the predicted ID value of the model. In order to obtain the minimum loss function, we use the Adam optimizer to adjust the parameters of each layer of the model: Where θ represents the model parameters and η is the learning rate. When the error reaches the stopping condition or the number of training times reaches the maximum, the training stops.

[0078] After training is completed, the model is evaluated and the validation set is used to test the performance of the model to ensure that the model has good generalization ability. By evaluating the accuracy of the model in processing unseen data, the model parameters are adjusted and optimized to achieve the best intrusion detection effect.

[0080] After the model training and evaluation is completed, it will be deployed to the real vehicle system to monitor and process the data on the CAN bus in real time. In actual application, the model will continuously monitor the incoming voltage differential signal, identify any potential abnormal activities in real time, and respond to possible intrusion threats in a timely manner.

[0081] The relevant technical solution is the same as the above embodiment and will not be described in detail here.

[0082] The above is a detailed introduction to the lightweight vehicle network intrusion detection system based on DBC files and voltage signals provided by the present invention. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referenced to each other.

[0083] The contents not described in detail in the specification of the present invention belong to the prior art known to the professional and technical personnel in this field.

Claims

1. A lightweight vehicle network intrusion detection system based on DBC files and voltage signals, characterized in that: The following steps are involved: 101: Obtain CAN ID and message type by parsing the DBC file of the vehicle CAN network, and use this information to build a detection model based on voltage signals of different types of messages; 102: using a high-precision analog-to-digital converter and FPGA to collect CAN differential voltage signals in the vehicle network; 103: Analyze and extract the characteristic value of each signal; 104: Use the lightweight neural network MobileNet to train the detection model constructed in step S1, and optimize the model to improve the detection speed and accuracy.

2. The lightweight vehicle network intrusion detection system based on DBC files and voltage signals according to claim 1 is characterized in that: In step 101: By parsing the DBC file obtained from the vehicle original equipment manufacturer (OEM), the communication matrix of the vehicle CAN network is constructed, and a correspondence table between message type and CAN ID is created according to the information provided by the communication matrix to map the message type and CANID.

3. The lightweight vehicle network intrusion detection system based on DBC files and voltage signals according to claim 1 is characterized in that: In step 102, the ID value and voltage signal of each data frame on the CAN bus are collected by combining the AD module, the MCP2515 CAN controller and the FPGA, wherein: The AD module is responsible for converting the analog voltage signal on the CAN bus into a digital signal for subsequent processing. During this conversion process, the AD module first processes the input voltage signal through its built-in voltage attenuation circuit, attenuating the voltage signal whose value fluctuates between -5 and +5V after being interfered by noise to a range of 0 to 2V, so as to meet the input requirements of the module and ensure the accuracy and stability of the signal. The attenuated voltage signal is then converted into a digital form, accurately reflecting the voltage changes on the CAN bus. The MCP2515 CAN controller in this system is mainly used to collect the ID values ​​of data frames transmitted on the CAN bus. It is connected to the FPGA through the SPI interface and set to the monitoring mode, which can receive but not interfere with the communication on the CAN bus. The high sensitivity and fast response capability of the MCP2515 enable it to capture each data frame on the CAN bus in real time and store it in the internal receiving buffer, so that the system can accurately analyze the communication data. The use of FPGA greatly improves the efficiency of data processing and the flexibility of the system; FPGA directly reads the ID of the data frame from the receiving buffer of MCP2515 through the SPI interface, and then uses its powerful processing capability to quickly perform preliminary analysis on the data, determine and extract the voltage signals of different fields of the CAN data frame; in addition, the IP core inside the FPGA is also responsible for further data processing, such as the calculation and temporary storage of eigenvalues, to provide support for subsequent data analysis and model training.

4. The lightweight vehicle network intrusion detection system based on DBC files and voltage signals according to claim 1 is characterized in that: In step 103, three modules, namely data acquisition, data processing and result transmission, are constructed in the FPGA to pre-process the data: The data acquisition module is responsible for receiving the voltage digital signal and its corresponding ID value after preliminary conversion from the AD module; this module ensures the real-time and integrity of the data and provides an accurate input source for subsequent data analysis and feature extraction; the data processing module is the core part of the system, which is responsible for extracting the characteristic values ​​of each signal; Although FPGA does not support complex floating-point operations, the floating-point operation IP core integrated in the module can perform accurate calculations on floating-point numbers; through these specially designed IP cores, the data processing module not only improves the computing efficiency, but also ensures the accuracy of the calculation process; the result transmission module stably sends the processed data to the connected computer system through a high-speed communication interface, supporting subsequent data analysis and machine learning model training.

5. The lightweight vehicle network intrusion detection system based on DBC files and voltage signals according to claim 1 is characterized in that: In step 104: After building the MobileNet lightweight neural network model for each type of signal, the system optimized each sub-model specifically to adapt to different types of CAN messages. Although these sub-models remain consistent in neural network structure, they have adjusted parameters and trained them according to the data type they process to ensure the optimal processing effect of the corresponding type of message. The model was trained using real data collected from a prototype CAN network bus. These data reflect the network behavior in normal and various abnormal situations. Through deep learning technology, the model can learn decisive features from complex input data, which helps to distinguish normal operations from potential security threats. The training process uses a loss function to optimize the classification results, and uses the Adam optimizer to adjust the network parameters to ensure that the model can achieve a high accuracy after multiple rounds of iterations; The verified system can be deployed in a real vehicle system to detect communications on the CAN bus in real time, classify and mark activities on the CAN network, and issue an immediate alarm once potential intrusion is detected.

Images