Networked vehicle CAN bus anomaly detection method based on CNN and Transform

Abstract

The invention discloses a networked vehicle CAN bus anomaly detection method based on a CNN and a Transform, and belongs to the field of vehicle-mounted network security. The method comprises the following steps: 1) collecting vehicle CAN data as a data set, segmenting the data set, and dividing the segmented data into a training set and a test set; 2) preprocessing the CAN data of the training set and the test set; (3) inputting the training set into the DM-CBCT network for training to obtain an anomaly detection model for the CAN data traffic of the networked vehicle, and (4) inputting the CAN data of the test set into the trained DM-CBCT model for anomaly detection. According to the method, the ant lion optimization algorithm is introduced to adaptively adjust the size of the receptive field, and the transformer module is introduced to capture the long-range dependency relationship in the CAN flow, so that the anomaly detection precision of the network-connected vehicle anomaly detection model in various attack scenes can be remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the field of vehicle network security, and in particular relates to a connected vehicle CAN bus anomaly detection method (DM-CBCT) based on CNN and Transformer. Background Art

[0002] With the implementation of the Internet of Vehicles, the interaction between vehicles and the outside world (such as infrastructure and vehicles) will lead to higher security risks for the on-board CAN network. Early anomaly detection can maximize the safety of vehicles and personnel.

[0003] The anomaly detection methods of connected car CAN are generally divided into two categories: model-based anomaly detection methods and data-driven anomaly detection methods. Model-based methods rely on strong professional knowledge to establish anomaly detection models. Due to its inherent complexity, the CAN protocol requires high professional knowledge, so it is difficult to establish an accurate model. At present, data-driven methods have been widely used in connected car CAN anomaly detection because they can automatically extract features and have low requirements for professional knowledge.

[0004] In recent years, the development of deep learning has provided opportunities for data-driven anomaly detection. Common deep learning methods include autoencoders, convolutional neural networks, long short-term memory networks, deep belief networks, and recurrent neural networks. Although data-driven anomaly detection methods are effective, in actual scenarios, the collected CAN data contains a lot of redundant information, which will seriously affect the accuracy of anomaly detection. Therefore, how to extract ID and data field features from CAN data to accurately estimate the type of CAN anomalies in connected vehicles remains a challenge. Summary of the invention

[0005] In view of the above problems existing in the prior art, the purpose of the present invention is to provide a connected vehicle CAN bus anomaly detection method based on CNN and Transformer, which is applied to the connected vehicle to solve the problem of internal CAN network anomaly detection.

[0006] The present invention provides the following technical solution: a method for detecting CAN bus anomalies of a connected vehicle based on CNN and Transformer, comprising the following steps:

[0007] 1) Obtain CAN bus data through the vehicle's OBD-II port. Use a sliding window to segment the CAN data and construct a fixed-length CAN message sequence. The segmented data is divided into a training set and a test set;

[0008] 2) Use the min-max normalization method to scale the CAN sequences of the training set and the test set to generate a data input format that meets the requirements of deep learning model training;

[0009] 3) Determine the overall structure and parameters of the DM-CBCT, a connected vehicle CAN network anomaly detection model based on CNN and Transformer, input the training set into DM-CBCT for training, and obtain an anomaly detection model for connected vehicle CAN traffic. The specific processing process of the training set in DM-CBCT is as follows:

[0010] 3.1) Automatically learn the ID and data field features in the input training set CAN sequence through the convolutional layer to capture the local dependencies in the CAN sequence;

[0011] 3.2) The input training set CAN sequence first uses the ant lion optimization algorithm in DM-CBCT to adaptively adjust the receptive field size of the CNN, and then passes through the transformer module in the anomaly detection model to obtain the global feature relationship of the CAN sequence;

[0012] 3.3) Input the CAN sequence features obtained by the convolutional neural network and transformer module after adjusting the receptive field in step 3.2) into the Softmax activation function to obtain the anomaly detection results;

[0013] 4) Input the CAN sequence of the test set into the trained DM-CBCT for anomaly detection.

[0014] Furthermore, the ant lion optimization algorithm is introduced into the convolutional layer to adaptively adjust the receptive field size of the convolutional neural network, and a transformer module is added after the convolutional layer.

[0015] Furthermore, in step 3.3), the specific process of the input training set CAN sequence, after adjusting the receptive field of the convolutional neural network and the transformer module, respectively adapting to the CAN sequence characteristics and obtaining the global dependency of the CAN sequence is as follows:

[0016] 3.2.1) The input CAN sequence is first adjusted by the antlion optimization algorithm to adjust the receptive field of the convolutional neural network. In the antlion optimization algorithm, ants are used to simulate the receptive field set of the convolutional neural network, and the antlion simulates the optimal receptive field.

[0017] 3.2.1.1) Ants perform random searches in the solution space to find food, that is:

[0018] X(t)=[0,cussum(2r(t1)-1),...,cussum(2r(t) n )-1)]

[0019] Where: X(t) is the set of steps of the ant's random walk, cumsum is the calculated cumulative sum, t is the number of steps of the random walk, and r(t) is a random function defined as:

[0020]

[0021] Where: the value range of rand is [0,1];

[0022] 3.2.1.2) Since there are boundaries in the feasible region, the ant random walk is normalized to update the position:

[0023]

[0024] Among them, a i is the minimum value of the random walk of the i-th dimension variable, b i is the maximum value of the random walk of the i-th dimension variable, is the minimum value of the i-th dimension variable at the t-th iteration, c i is the minimum value of all variables in the i-th dimension, is the maximum value of the i-th dimension variable at the t-th iteration;

[0025] 3.2.1.3) Antlions set traps to influence the routes of ants’ random walks:

[0026]

[0027] Among them, c t is the minimum value of all variables at the tth iteration, d t is the maximum value of all variables at the tth iteration, is the position of the jth antlion at the tth iteration; once an ant falls into the trap made by the antlion, the antlion will throw sand to the edge of the trap to prevent the ant from escaping:

[0028]

[0029] Where I is the proportionality coefficient;

[0030] 3.2.1.4) When the fitness value of the ant is greater than that of the antlion, it is considered that the antlion has captured it. At this time, the antlion will update the trap according to the position of the ant:

[0031]

[0032] in, represents the position of the ith ant at the tth iteration; f is the fitness function. After multiple iterations, the optimal receptive field size is determined.

[0033] 3.2.2) The optimal receptive field size obtained by adaptively using the Ant Lion Optimization Algorithm in CNN is used to capture the global dependencies in the CAN sequence through the transformer module; the details are as follows:

[0034] 3.2.2.1) Let d emb , d k , d v , n represents the dimension of the word embedding vector, the dimension of the key vector, the dimension of the value vector and the number of parallel attention layers respectively; for each parallel attention layer, the output query vector of the previous decoder corresponding to the i-th position is used And pack the encoder outputs of all positions into a value of Key is Matrix of

[0035] 3.2.2.2) is the calculation output Each set of attention layers maps the input to a different sub-representation space, allowing the model to focus on different locations in different sub-representation spaces; that is:

[0036]

[0037]

[0038]

[0039] Among them, the projection matrix and W O is the learning parameter of the nth parallel attention layer; each parallel attention layer adopts scaled dot product attention:

[0040]

[0041] vector represents the attention probability vector corresponding to the i-th target token on all sources, calculated by the j-th attention head;

[0042] For all attention heads, the attention probability vector of all target labels is Combined together, we can construct an attention matrix A I×J ; Attention matrix A I×J It shows how much the model pays attention to each position in the source sequence at each specific position when generating the entire target sequence.

[0043] Furthermore, in the step 3, the CNN and Transformer-based connected vehicle CAN network anomaly detection model DM-CBCT adopts a cross-entropy loss function adjustment strategy for network training, and uses a cross-entropy loss function to evaluate the network training and verification losses.

[0044] By adopting the above technology, compared with the prior art, the beneficial effects of the present invention are as follows:

[0045] The method of the present invention uses a convolutional neural network combined with the antlion optimization algorithm and the transformer module to learn and obtain important features in the input CAN sequence. By introducing the antlion optimization algorithm to adaptively adjust the receptive field size, and introducing the transformer module to capture long-distance dependencies in CAN traffic, the anomaly detection accuracy of the anomaly detection model in various attack scenarios can be significantly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a flow chart of the method of the present invention;

[0047] Figure 2 1 is a diagram of various abnormal CAN sequence data in the embodiments of the present invention; wherein (a) is a normal CAN sequence data diagram, (b) is a CAN sequence data diagram under DoS attack, (c) is a CAN sequence data diagram under Fuzzy attack, (d) is a CAN sequence data diagram under Gear attack, and (e) is a CAN sequence data diagram under RPM attack;

[0048] Figure 3 It is a schematic diagram of the overall structure of the connected vehicle CAN anomaly detection model DM-CBCT based on CNN and Transformer in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments of the specification. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0050] On the contrary, the present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention as defined by the claims. Further, in order to make the public have a better understanding of the present invention, some specific details are described in detail in the detailed description of the present invention below. Those skilled in the art can fully understand the present invention without the description of these details.

[0051] See also Figure 1-3 ,Connected car CAN anomaly detection method based on CNN and Transformer, such as Figure 1 As shown, the following steps are included:

[0052] S1: Obtain CAN bus traffic through the vehicle's OBD-II port. The dataset contains five message types, including normal, DoS attack (injecting messages with "0x000" CAN ID every 0.3 milliseconds), Fuzzy attack (injecting messages with random CANID and CAN data every 0.5 milliseconds), Gear attack (injecting messages related to Gear every 1 millisecond) and RPM attack (injecting messages related to RPM every 1 millisecond). The composition of CAN data in the dataset is detailed in Table 1. Use a sliding window with a window size of 100 and a step size of 50 to segment the CAN data and construct a fixed-length CAN message sequence. The segmented data is divided into a training set and a test set.

[0053] Table 1 CAN data composition in the dataset

[0054] Message Type Total number of messages Normal message quantity Number of injected messages normal 988987 988872 0 DoS Attack 3665771 3078250 587521 Fuzzy Attack 3838860 3347013 491847 Gear Attack 4443142 3845890 597252 RPM Attack 4621702 3966805 654897

[0055] S2: We use the min-max standardization method to scale the CAN sequences of the training set and the test set to generate data input formats that meet the requirements of deep learning model training; we visualize different types of CAN sequences, such as Figure 2 As shown;

[0056] S3: Build Figure 3 The CNN and Transformer-based connected vehicle CAN network anomaly detection model DM-CBCT is shown. The training set is input into DM-CBCT for training to obtain an anomaly detection model for connected vehicle CAN traffic. The specific processing process of the training set in DM-CBCT is as follows:

[0057] S3.1: Automatically learn the ID and data field features in the input training set CAN sequence through the convolutional layer to capture the local dependencies in the CAN sequence;

[0058] S3.2: The input training set CAN sequence first uses the ant lion optimization algorithm in DM-CBCT to adaptively adjust the receptive field size of the CNN, and then passes through the transformer module in the anomaly detection model to obtain the global feature relationship of the CAN sequence.

[0059] The specific process is as follows:

[0060] 3.2.1) Input CAN sequence to the convolutional neural network after adjusting the receptive field through the antlion optimization algorithm; in the antlion optimization algorithm, ants are used to simulate the receptive field set of the convolutional neural network, and the antlion simulates the optimal receptive field; the details are as follows:

[0061] 3.2.1.1) Ants perform random searches in the solution space to find food, that is:

[0062] X(t)=[0,cussum(2r(t1)-1),...,cussum(2r(t) n )-1)]

[0063] Where: X(t) is the set of steps of the ant's random walk, cumsum is the calculated cumulative sum, t is the number of steps of the random walk, and r(t) is a random function defined as:

[0064]

[0065] Where: the value range of rand is [0,1];

[0066] 3.2.1.2) Since there are boundaries in the feasible region, the ant random walk is normalized to update the position:

[0067]

[0068] Among them, a i is the minimum value of the random walk of the i-th dimension variable, b i is the maximum value of the random walk of the i-th dimension variable, is the minimum value of the i-th dimension variable at the t-th iteration, c i is the minimum value of all variables in the i-th dimension, is the maximum value of the i-th dimension variable at the t-th iteration;

[0069] 3.2.1.3) Antlions set traps to influence the routes of ants’ random walks:

[0070]

[0071] Among them, c t is the minimum value of all variables at the tth iteration, d t is the maximum value of all variables at the tth iteration, is the position of the jth antlion at the tth iteration; once an ant falls into the trap made by the antlion, the antlion will throw sand to the edge of the trap to prevent the ant from escaping:

[0072]

[0073] Where I is the proportionality coefficient;

[0074] 3.2.1.4) When the fitness value of the ant is greater than that of the antlion, it is considered that the antlion has captured it. At this time, the antlion will update the trap according to the position of the ant:

[0075]

[0076] in, represents the position of the i-th ant at the t-th iteration; f is the fitness function; after multiple iterations, the optimal receptive field size is determined;

[0077] 3.2.2) The optimal receptive field size obtained by adaptively using the Ant Lion Optimization Algorithm in CNN is used to capture the global dependencies in the CAN sequence through the transformer module as follows:

[0078] 3.2.2.1) Let d emb , d k , d v , n represents the dimension of the word embedding vector, the dimension of the key vector, the dimension of the value vector and the number of parallel attention layers respectively; for each parallel attention layer, the output query vector of the previous decoder corresponding to the i-th position is used And pack the encoder outputs of all positions into a value of Key is Matrix of

[0079] 3.2.2.2) is the calculation output M(q i ,k,v), each set of attention layers maps the input to different sub-representation spaces, allowing the model to focus on different positions in different sub-representation spaces; that is:

[0080]

[0081]

[0082] Among them, the projection matrix and W O is the learning parameter of the nth parallel attention layer; each parallel attention layer adopts scaled dot product attention:

[0083]

[0084]

[0085] vector represents the attention probability vector corresponding to the i-th target token on all sources, calculated by the j-th attention head;

[0086] For all attention heads, the attention probability vector of all target labels is Combined together, we can construct an attention matrix A I×J ; Attention matrix A I×J It shows how much the model pays attention to each position in the source sequence at each specific position when generating the entire target sequence.

[0087] 3.3) Input the CAN sequence features obtained by the Ant Lion optimization algorithm and the transformer module in step 3.2) into the Softmax activation function to obtain the anomaly detection results;

[0088] S4: Input the CAN sequence of the test set into the trained DM-CBCT for anomaly detection.

[0089] Among them, the connected vehicle CAN network anomaly detection model DM-CBCT based on CNN and Transformer adopts the cross-entropy loss function adjustment strategy for network training, and uses the cross-entropy loss function to evaluate the training and verification losses of the network.

[0090] Table 2 Anomaly detection results of the CNN and Transformer-based connected vehicle CAN network anomaly detection model DM-CBCT proposed in this embodiment and the existing anomaly detection model

[0091] Model Accuracy Precision Recall F1-Score Inception 0.7 0.5 0.6667 0.5714 ANN 0.82 0.83 0.81 0.82 SVM 0.91 0.92 0.89 0.90 VGG16 0.9671 0.9355 0.9671 0.9510 LSTM 0.9603 0.9618 0.9617 0.9682 Autoencoder 0.9998 0.9996 0.9985 0.9996 DM-CBCT 0.9996 0.9998 0.9998 0.9998

[0092] By comparing the various performance indicators of anomaly detection in Table 2, it can be seen that this embodiment improves the accuracy and reliability of anomaly detection compared with the existing method, and can effectively and accurately detect CAN anomalies of connected vehicles.

[0093] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A connected vehicle CAN bus anomaly detection method based on CNN and Transformer, characterized in that: The following steps are involved: 1) Obtain CAN bus data through the vehicle's OBD-II port, use a sliding window to segment the CAN data, construct a fixed-length CAN message sequence, and divide the segmented data into a training set and a test set; 2) Use the min-max normalization method to scale the CAN sequences of the training set and the test set to generate a data input format that meets the requirements of deep learning model training; 3) Determine the overall structure and parameters of the DM-CBCT, a connected vehicle CAN network anomaly detection model based on CNN and Transformer, input the training set into DM-CBCT for training, and obtain an anomaly detection model for connected vehicle CAN traffic. The specific processing process of the training set in DM-CBCT is as follows: 3.1) Automatically learn the ID and data field features in the input training set CAN sequence through the convolutional layer to capture the local dependencies in the CAN sequence; 3.2) The input training set CAN sequence is used to adaptively adjust the receptive field size of CNN through the ant lion optimization algorithm in DM-CBCT, and then passes through the transformer module in the anomaly detection model to obtain the global feature relationship of the CAN sequence; 3.3) Input the CAN sequence features of the connected vehicle obtained by the convolutional neural network and transformer module after adjusting the receptive field in step 3.2) into the Softmax activation function to obtain the anomaly detection results; 4) Input the CAN sequence of the test set into the trained DM-CBCT for anomaly detection.

2. The method for constructing an abnormality detection model based on the CAN bus of a networked vehicle according to claim 1 is characterized in that: The ant lion optimization algorithm is introduced into the convolutional layer of the DM-CBCT model to adaptively adjust the receptive field size of the convolutional neural network, and a transformer module is added after the convolutional layer.

3. The method for constructing an abnormality detection model based on the CAN bus of a networked vehicle according to claim 2 is characterized in that, in the step 3.2), the input training set CAN sequence is subjected to the convolutional neural network and the transformer module after adjusting the receptive field, respectively adapting the CAN sequence characteristics and obtaining the global dependency of the CAN sequence, and the specific process is as follows: 3.2.1) Input CAN sequence to the convolutional neural network after adjusting the receptive field through the antlion optimization algorithm; in the antlion optimization algorithm, ants are used to simulate the receptive field set of the convolutional neural network, and the antlion simulates the optimal receptive field; the details are as follows: 3.2.1.1) Ants perform random searches in the solution space to find food, that is: X(t)=[0,cussum(2r(t1)-1),...,cussum(2r(t n )-1)] Where: X(t) is the set of steps of the ant's random walk, cumsum is the calculated cumulative sum, t is the number of steps of the random walk, and r(t) is a random function defined as: Where: the value range of rand is [0,1]; 3.2.1.2) Since there are boundaries in the feasible region, the ant random walk is normalized to update the position: Among them, a i is the minimum value of the random walk of the i-th dimension variable, b i is the maximum value of the random walk of the i-th dimension variable, is the minimum value of the i-th dimension variable at the t-th iteration, c i is the minimum value of all variables in the i-th dimension, is the maximum value of the i-th dimension variable at the t-th iteration; 3.2.1.3) Antlions set traps to influence the routes of ants’ random walks: Among them, c t is the minimum value of all variables at the tth iteration, d t is the maximum value of all variables at the tth iteration, is the position of the jth antlion at the tth iteration; once the ant falls into the trap made by the antlion, the antlion will throw sand to the edge of the trap to prevent the ant from escaping: Where I is the proportionality coefficient; 3.2.1.4) When the fitness value of the ant is greater than that of the antlion, it is considered that the antlion has captured it. At this time, the antlion will update the trap according to the position of the ant: in, represents the position of the i-th ant at the t-th iteration; f is the fitness function; after multiple iterations, the optimal receptive field size is determined; 3.2.2) The optimal receptive field size obtained by adaptively using the Ant Lion Optimization Algorithm in CNN is used to capture the global dependencies in the CAN sequence through the transformer module as follows: 3.2.2.1) Let d emb , d k , d v , n represents the dimension of the word embedding vector, the dimension of the key vector, the dimension of the value vector and the number of parallel attention layers respectively; for each parallel attention layer, the output query vector of the previous decoder corresponding to the i-th position is used And pack the encoder outputs of all positions into a value of Key is Matrix of 3.2.2.2) is the calculation output M(q i ,k,v), each set of attention layers maps the input to different sub-representation spaces, allowing the model to focus on different positions in different sub-representation spaces; that is: in, Projection Matrix and W O is the learning parameter of the nth parallel attention layer; each parallel attention layer adopts scaled dot product attention: vector represents the attention probability vector corresponding to the i-th target token on all sources, calculated by the j-th attention head; For all attention heads, the attention probability vector of all target labels is Combined together, we can construct an attention matrix A I×J ; Attention matrix A I×J It shows how much the model pays attention to each position in the source sequence at each specific position when generating the entire target sequence.

4. The method for detecting abnormality of the CAN bus of a connected vehicle based on CNN and Transformer according to claim 1 is characterized in that: In the step 3, the CAN network anomaly detection model DM-CBCT based on CNN and Transformer adopts a cross-entropy loss function adjustment strategy for network training, and uses a cross-entropy loss function to evaluate the training and verification losses of the network.

Images