A lightweight vehicle network intrusion detection system based on DBC files and voltage signals

Abstract

This invention discloses a lightweight in-vehicle network intrusion detection system based on DBC files and voltage signals, belonging to the field of vehicle communication network security. The system parses in-vehicle DBC files, mapping five different types of CAN messages to their ID value ranges, thereby constructing five MobileNet neural network sub-models to identify attack behaviors targeting different message types. The system implementation includes DBC file analysis, signal sampling, data preprocessing, feature extraction, and model building and training. Finally, it undergoes comprehensive testing in a prototype network containing five CAN devices. Test results show that this system has higher detection accuracy and shorter detection time compared to traditional in-vehicle network intrusion detection systems. This lightweight intrusion detection system effectively improves the data processing speed and security of in-vehicle systems, ensuring the secure operation of in-vehicle networks in complex environments.

Description

Technical Field

[0001] This invention belongs to the field of vehicle communication network security and relates to a lightweight vehicle network intrusion detection system based on DBC files and voltage signals. Background Technology

[0002] As a key technology connecting various electronic control units (ECUs), the security of the vehicle's controller local area network (CAN) directly impacts vehicle operational safety and data privacy. However, traditional CAN networks, lacking effective authentication and data confidentiality mechanisms from their initial design, are vulnerable to security threats. This vulnerability is particularly pronounced as vehicles interact more frequently with the internet, other vehicles, and roadside infrastructure, increasing the likelihood of attacks on vehicle systems.

[0003] To effectively detect attacks targeting vehicular networks, numerous researchers have designed various intrusion detection systems (IDS), primarily categorized into CAN packet-based IDS and ECU hardware-based IDS. CAN packet-based IDS mainly study periodic CAN data and lack effective processing for non-periodic frames; ECU hardware-based IDS require substantial computational resources, limiting their practicality in vehicular systems. Furthermore, these systems typically require significant storage space and processing power, increasing the cost and complexity of vehicle systems. Therefore, developing a lightweight, efficient security detection system that can adapt to various vehicular network environments is of paramount importance.

[0004] This invention proposes a lightweight in-vehicle network intrusion detection system based on DBC (Database CAN) files and voltage signal analysis. By analyzing DBC files, each CAN ID and its corresponding message type in the CAN network are obtained, and a detection model based on CAN signal voltage is established for each message type. Considering the high demands of real-time performance and computational efficiency in the in-vehicle network environment, the model uses a lightweight MobileNet neural network, achieving an optimal balance between detection speed and accuracy, making it suitable for automotive embedded systems. Summary of the Invention

[0005] Addressing the shortcomings of existing vehicle network security technologies, this invention discloses a lightweight in-vehicle network intrusion detection system based on DBC files and voltage signals, which improves the security detection efficiency of vehicle networks, particularly in the ability to identify network anomalies and potential threats in real time.

[0006] To achieve the above objectives, the present invention discloses a vehicle-mounted network intrusion detection system, comprising:

[0007] Parse the DBC file of the vehicle CAN network to obtain the CAN communication matrix.

[0008] Based on the CAN communication matrix, different message types are combined with their corresponding CAN ID ranges to form a table that maps message types to CAN IDs.

[0009] The system acquires the ID value and differential voltage signal corresponding to each data frame on the CAN bus, and uses a high-precision analog-to-digital converter (AD module) to convert the captured analog voltage signal into a digital signal.

[0010] The characteristic values ​​of each signal are calculated and stored using an FPGA (model: Xilinx ZYNQ-7Z035).

[0011] Based on the message type and ID value of each data frame, the messages are divided into 5 categories, and models are trained for each category.

[0012] It monitors the signals transmitted on the CAN bus in real time and issues an alarm for intrusion signals.

[0013] According to the present invention, a lightweight vehicle network intrusion detection system based on DBC files and voltage signals is provided, wherein the voltage signals mainly include the voltages of the RTR, Control, Data and CRC fields of the CAN data frame.

[0014] The five message types are: Periodic, On-event, Ifactive, Periodic and On-event, and Periodic and Ifactive.

[0015] According to the lightweight vehicle network intrusion detection system based on DBC files and voltage signals provided by the present invention, the features are extracted using an FPGA, and three modules—data acquisition, data processing, and result transmission—are constructed in the FPGA:

[0016] Data acquisition module: Acquires the voltage digital signal and its ID value collected by the AD module, and uses it as the module's output.

[0017] Data processing module: It takes the output of the data acquisition module as the input of this module, calculates the characteristic values ​​of each input signal, and uses the calculation results as the output of the module.

[0018] Result transmission module: The output of the computational data processing module is used as the input of this module and transmitted to the computer for model training.

[0019] Signal characteristics include: maximum value, minimum value, average value, mean deviation, skewness, kurtosis, root mean square, and centroid.

[0020] According to the lightweight vehicle network intrusion detection system based on DBC files and voltage signals provided by the present invention, the MobileNet model is one of the core components, which uses depthwise separable convolution to reduce computation and model size.

[0021] Five sub-models are built, each specializing in handling a specific type of message. These sub-models are consistent in their neural network architecture but have specific training parameters tuned for their respective data types.

[0022] The output of the neural network is a classification decision that indicates whether the current network state is normal or whether there is a potential intrusion threat.

[0023] The eight feature values ​​output by the FPGA are used as inputs to this model, and the feature values ​​are reshaped into 2×4 dimensional data.

[0024] The first layer of the MobileNet model is a standard convolutional layer, using 32 3×3 convolutional kernels with a stride of 1, and employing "same" padding to maintain consistent spatial dimensions between the output and input.

[0025] Depthwise separable convolution (DW) blocks are used to process the output from the first layer. In this process, a convolution kernel is applied independently to each input channel.

[0026] Pointwise convolution (PW convolution) blocks take the output of depthwise separable convolution as input and combine feature channels from depthwise convolution to expand the width of the feature map.

[0027] The outputs of both the DW and PW convolutional blocks are batch normalized and ReLU activated to maintain the nonlinearity of the network and the responsiveness of the model.

[0028] Global Average Pooling (GAP) maps the output of pointwise convolutional layers to feature vectors, significantly reducing model parameters and preventing overfitting.

[0029] The fully connected layer outputs the final prediction result.

[0030] Fully connected layers use the softmax activation function to compute and output predictions.

[0031] The input data is examined, and the predicted ID value is compared with the collected ID values.

[0032] If the predicted ID value matches the collected ID value, the CAN device corresponding to that ID value is considered a legitimate sender.

[0033] If the predicted ID value does not match the obtained ID value, the input data is put into the sub-model corresponding to the predicted ID for further testing.

[0034] If the output ID value from another sub-model matches the actual ID value, it is assumed that the ECU corresponding to that ID value comes from the CAN prototype and has been compromised.

[0035] Otherwise, the ECU corresponding to that ID value will be considered an external, illegal, or malicious node.

[0036] In general, the present invention has the following beneficial effects:

[0037] 1. This invention, through in-depth analysis of DBC files and real-time monitoring of voltage signals, effectively improves the security of vehicle networks. The system can quickly and accurately identify and respond to various network anomalies and potential security threats, ensuring vehicle driving safety.

[0038] 2. This invention utilizes a high-precision analog-to-digital converter (FPGA) for voltage signal processing, combined with a MobileNet neural network, significantly improving detection speed and accuracy. This lightweight detection mode is well-suited for embedded systems, maintaining high efficiency while ensuring low resource consumption.

[0039] 3. The intrusion detection system of this invention designs multiple sub-models for different CAN message types. Each model is specifically trained to adapt to its corresponding data type. This method improves the system's adaptability and detection accuracy against various attacks, enabling the system to have better defense against diverse communication modes and potential threats. Attached Figure Description

[0040] Figure 1 A schematic diagram of the detection process of a lightweight vehicle network intrusion detection system based on DBC files and voltage signals provided for the implementation of this invention;

[0041] Figure 2 A CAN network prototype diagram of a lightweight vehicle network intrusion detection system based on DBC files and voltage signals provided for the implementation of this invention;

[0042] Figure 3 A flowchart of data preprocessing for a lightweight vehicle network intrusion detection system based on DBC files and voltage signals, provided for the implementation of this invention;

[0043] Figure 4This is a schematic diagram illustrating the data training of a lightweight vehicle network intrusion detection system based on DBC files and voltage signals, provided for the implementation of this invention. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0045] The core of this invention is to provide a lightweight vehicle network intrusion detection system based on DBC files and voltage signals, which can analyze voltage changes in the vehicle CAN network in real time, quickly identify and respond to potential security threats, so as to ensure the security of the vehicle network.

[0046] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0047] 101: Parse the DBC file of the vehicle CAN network to form a table corresponding to message types and CAN IDs.

[0048] Use the Vector CANdb++ editor to parse the DBC files obtained from the vehicle's original equipment manufacturer (OEM). These DBC files contain detailed information about all messages in the vehicle's CAN network, such as message identifiers (IDs), lengths, periodicity, signals, and their attributes.

[0049] By parsing the obtained data, the communication matrix of the vehicle's CAN network is acquired. This matrix records in detail the name, ID, type, length, and signals contained in each message.

[0050] The acquired communication matrix is ​​further analyzed, and a mapping table between message types and CAN IDs is created based on the information provided by the communication matrix, thus mapping the message types and CAN IDs.

[0051] 102: Collect the ID value and differential voltage signal corresponding to each data frame on the CAN bus.

[0052] In this embodiment, the system uses a method that combines the independent CAN controller MCP2515 CAN with an FPGA to capture the ID value of each message on the CAN bus.

[0053] Specifically, such as Figure 2As shown, the MCP2515 is connected to the FPGA via the SPI interface, and its working mode is set to listen mode so that it only receives messages without affecting the bus status.

[0054] When data transmission occurs on the CAN bus, the MCP2515 automatically stores the message in the receive buffer.

[0055] The FPGA reads the ID of the received data frame directly from the receive buffer of the MCP2515 via the SPI interface and stores it in a set register.

[0056] In this embodiment, the system uses a combination of a dual-channel AD module (chip model: 3PA1030) and an FPGA to capture the differential voltage signal of each message on the CAN bus.

[0057] Specifically, such as Figure 2 As shown, in the CAN prototype system, CAN signal transceiver modules T1, T2, T3, T4 and T5 are connected to the AD module through two lines, CAN_H and CAN_L.

[0058] On the CAN bus, the potential difference between the CAN_H and CAN_L lines is designed to represent CAN signals. The potential difference on the CAN bus is divided into dominant level (logic 0) and recessive level (logic 1). When a recessive signal is transmitted on the CAN bus, both lines are at 2.5V. When a dominant signal is transmitted, the CAN-H voltage rises to 3.5V, while the CAN-L voltage drops to 1.5V. The differential voltage range on the CAN bus is 0 to 2V.

[0059] Although logic 0 and logic 1 can be accurately distinguished from CAN-H and CAN-L signals, these two signals exhibit certain fluctuations at the physical level, which usually reflect the characteristics of their source ECU. Interference between CAN-H and CAN-L signals typically occurs synchronously, and differential signals can effectively cancel out this interference, thus ensuring signal stability and reliability. Therefore, this solution uses an AD module to acquire the differential voltage signal from the CAN bus.

[0060] In practical applications, external noise can affect the measurement, and the measured differential voltage value may deviate from the theoretical range of 0 to 2V. Therefore, the AD module used in this solution includes a voltage attenuation circuit that can accept voltages between -5V and +5V and attenuate them to 0 to 2V.

[0061] Due to the arbitration mechanism of the CAN bus, multiple ECUs may attempt to send data simultaneously, causing specific fields on the CAN bus, such as the acknowledgment (ACK) field, to be affected by the combined influence of multiple ECUs. Therefore, this solution focuses only on the voltage signal between the Remote Transmission Request (RTR) field and the Cyclic Redundancy Check (CRC) field. This part of the signal is less susceptible to interference and is more suitable for extracting unique characteristics of the ECU.

[0062] The AD module converts analog voltage signals into digital signals and stores them in the FPGA's registers.

[0063] 103: Calculate and extract the characteristic values ​​of each voltage signal.

[0064] To effectively distinguish between normal and abnormal data frames, the system needs to extract corresponding feature values ​​from the differential voltage signal of each CAN frame. These feature values ​​include maximum value, minimum value, average value, mean deviation, skewness, kurtosis, root mean square, and centroid.

[0065] In this embodiment, the system uses an FPGA to calculate and extract the feature values ​​of each voltage signal.

[0066] Specifically, such as Figure 3 As shown, three data preprocessing modules are set up in the FPGA.

[0067] The data acquisition module is used to acquire the voltage digital signal and its ID value collected by the AD module, and transmit it to the data processing module. The data processing module then calculates the characteristic value of each signal and transmits the calculation result to the result transmission module. The result transmission module then transmits the characteristic value to the computer for model training.

[0068] Since the acquired voltage values ​​and calculated characteristic values ​​are both floating-point numbers, and these floating-point numbers are stored in the FPGA in IEEE 754 format, we configured two input registers (register A and register B) and seven output registers in the data processing module. Input register A is configured to directly receive the raw voltage values ​​obtained from the data acquisition section, and input register B is configured to store the voltage data converted to IEEE format.

[0069] Because floating-point numbers cannot be directly calculated in an FPGA, we integrated dedicated floating-point arithmetic IP cores into the data processing module to perform various mathematical operations, thereby calculating the required voltage characteristic values. These IP cores simplify the calculation process and improve development efficiency.

[0070] The calculated feature values ​​are stored in seven output registers configured in the FPGA. These feature values ​​are then fed into the neural network model for training and classification. After all feature values ​​have been calculated, the system's transmission module sends the results to a connected computer for subsequent model building and analysis.

[0071] 104: Construct lightweight MobileNet neural network models for various types of signals.

[0072] Based on the information provided by the CAN communication matrix, the information transmitted on the CAN bus can be divided into five types. Accordingly, we establish five sub-models, each specializing in handling a specific type of message. These sub-models are consistent in their neural network structure but have specific training parameters tuned for their respective data types.

[0073] Specifically, the structure of the MobileNet model is as follows: Figure 4 As shown.

[0074] First, the eight input feature values ​​are reshaped into 2×4 dimensional data. Then, the reshaped data is directly input into the neural network for a series of transformations and learning processes.

[0075] Create the first convolutional block of the model: X i W represents the input data for this layer. (1) and b 1 These represent the weights and biases of the convolutional layer, respectively. BN represents batch normalization of the output of this layer to stabilize the learning process. This layer uses 32 3x3 convolutional kernels with a stride of 1. 'Same' padding is used to maintain the same spatial dimension as the input. The ReLU activation function is applied to the batch-normalized output to introduce non-linearity and enhance the model's expressive power. The purpose of this layer is to extract primary features from the input data.

[0076] Create a depthwise separable convolutional block: Depthwise separable convolutional blocks will convert the output of the previous layer into a single convolutional block. As the input to this layer, the output is obtained after convolution. Pointwise convolutional blocks output the depthwise separable convolutional blocks. As input, each input channel is independently applied a convolutional kernel, and the output... Create another pointwise convolutional block: W (2) b 2 and W (3) b 3These represent the weights and biases of the DW and PW layers, respectively. The outputs of these two steps are also batch normalized and ReLU activated. Using these two convolutional blocks increases the depth and complexity of the network, thereby improving the model's learning ability.

[0077] Establish an average pooling layer: The average pooling layer takes the output of the PW layer as input, and GAP represents the global average pooling operation. The output after this operation maps features to feature vectors, significantly reducing the number of parameters and helping to avoid overfitting. A fully connected layer is then established. Fully connected layer will The results are taken as input, and the softmax activation function is applied to the calculation results to output the prediction results.

[0078] Define the loss function L: Here, represents the actual ID value of the training data, and represents the predicted ID value of the model. To obtain the minimum loss function, we use the Adam optimizer to tune the parameters of each layer of the model: Where θ represents the model parameters and η is the learning rate. Training stops when the error reaches the stopping condition or the number of training iterations reaches its maximum value.

[0079] After training, the model is evaluated using a validation set to test its performance and ensure good generalization ability. By assessing the model's accuracy in handling unseen data, the model parameters are adjusted and optimized to achieve the best intrusion detection results.

[0080] After model training and evaluation, it is deployed to the real vehicle system to monitor and process data on the CAN bus in real time. In practical applications, the model will continuously monitor incoming voltage differential signals, identify any potential abnormal activity in real time, and respond promptly to possible intrusion threats.

[0081] The relevant technical solutions are the same as those in the above embodiments, and will not be repeated here.

[0082] The lightweight vehicle network intrusion detection system based on DBC files and voltage signals provided by this invention has been described in detail above. The various embodiments in the specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between the embodiments can be referred to interchangeably.

[0083] The contents not described in detail in this specification are existing technologies known to those skilled in the art.

Claims

1. A lightweight vehicle network intrusion detection system based on DBC files and voltage signals, characterized in that, Includes the following steps: 101: Obtain the CAN ID and message type by parsing the DBC file of the vehicle CAN network, and use this information to build a detection model of voltage signal based on different message types; 102: Acquire CAN differential voltage signals in the vehicle network using a high-precision analog-to-digital converter and FPGA; 103: Analyze and extract the feature values ​​of each signal; 104: Train the detection model built in step 101 using the lightweight neural network MobileNet, and optimize the model to improve detection speed and accuracy; In step 102: the ID value and voltage signal of each data frame on the CAN bus are acquired using an AD module, an MCP2515 CAN controller, and an FPGA. The AD module is responsible for converting analog voltage signals on the CAN bus into digital signals for subsequent processing. During this conversion, the AD module first processes the input voltage signal through its built-in voltage attenuation circuit, reducing the voltage signal value fluctuation range from -5 to +5V after noise interference to a range of 0 to 2V to meet the module's input requirements and ensure signal accuracy and stability. The attenuated voltage signal is then converted into digital form, accurately reflecting the voltage changes on the CAN bus. The MCP2515 CAN controller in this system is used to collect the ID values ​​of data frames transmitted on the CAN bus. It is connected to the FPGA via the SPI interface and set to listening mode, so that it can receive data without interfering with communication on the CAN bus. The high sensitivity and fast response of the MCP2515 enable it to capture each data frame on the CAN bus in real time and store it in the internal receive buffer, so that the system can accurately analyze the communication data. The use of FPGA greatly improves the efficiency of data processing and the flexibility of the system. The FPGA directly reads the ID of the data frame from the receive buffer of the MCP2515 through the SPI interface, and then uses its powerful processing capabilities to quickly perform preliminary analysis on these data, determine and extract the voltage signals of different fields of the CAN data frame. In addition, the IP core inside the FPGA is also responsible for further data processing, feature value calculation and temporary storage, providing support for subsequent data analysis and model training. In step 103, three modules—data acquisition, data processing, and result transmission—are constructed in the FPGA to preprocess the data: The data acquisition module is responsible for receiving the initially converted voltage digital signals and their corresponding ID values ​​from the AD module. This module ensures the real-time performance and integrity of the data, providing an accurate input source for subsequent data analysis and feature extraction. The data processing module is the core of the system, responsible for extracting the feature values ​​of each signal. Although the FPGA does not support complex floating-point operations, the integrated floating-point operation IP cores within the module can perform accurate floating-point calculations. Through these specially designed IP cores, the data processing module not only improves computational efficiency but also ensures the accuracy of the calculation process. The result transmission module stably sends the processed data to the connected computer system through a high-speed communication interface, supporting subsequent data analysis and training of machine learning models.

2. The lightweight vehicle network intrusion detection system based on DBC files and voltage signals according to claim 1, characterized in that, In step 101: by parsing the DBC file obtained from the vehicle's original equipment manufacturer, a communication matrix for the vehicle's CAN network is constructed, and a correspondence table between message types and CAN IDs is created based on the information provided by the communication matrix, thus mapping the message types and CAN IDs.

3. The lightweight vehicle network intrusion detection system based on DBC files and voltage signals according to claim 1, characterized in that, In step 104: After constructing MobileNet lightweight neural network models for various signal types, the system performs specialized optimizations on each sub-model to adapt to different types of CAN messages. Although these sub-models maintain a consistent neural network structure, they are each trained and adjusted for the data types they process to ensure optimal processing performance for the corresponding message types. During the training of the model, real data collected from the prototype CAN network bus was used, which reflects network behavior under normal and various abnormal conditions. Through deep learning technology, the model is able to learn decisive features from complex input data, which helps to distinguish normal operation from potential security threats. The training process uses a loss function to optimize the classification results and uses the Adam optimizer to adjust the network parameters to ensure that the model can achieve a high accuracy after multiple iterations. The validated system can be deployed in real vehicle systems to monitor communication on the CAN bus in real time, classify and label activities on the CAN network, and issue an alarm immediately once a potential intrusion is detected.

Images