Internet of vehicles intrusion detection system based on T-BOX

Abstract

The invention discloses an Internet of Vehicles intrusion detection system based on T-BOX, and mainly relates to the field of vehicle-mounted network protection. Comprising a data acquisition and processing module, a training module, a detection module and a supervision platform. The data acquisition and processing module has a data acquisition function and a data processing function, and the data acquisition function needs to provide input interfaces for different conditions; the data processing function is used for preprocessing the collected data; the main task of the training module is to obtain a model capable of performing intrusion detection; the detection module is used for detecting T-BOX data input by the system by using the trained model in the training module and generating a corresponding evaluation index; the supervision platform realizes network security abnormity monitoring functions such as real-time monitoring and vehicle scheduling. The method has the beneficial effects that intrusion data can be identified or detected, the safety of the vehicle-mounted T-BOX is protected, and the risk that the data center of the Internet of Vehicles encounters hacker intrusion is avoided.

Description

Technical Field

[0001] The present invention relates to the field of vehicle network protection, and in particular to a vehicle network intrusion detection system based on T-BOX. Background Art

[0002] With the rapid development of Internet technology, various high-tech technologies are gradually being used in automobiles, and smart connected cars are beginning to enter the public's field of vision. However, while smart connected cars provide many convenient functions and a good driving experience, they also bring more security risks. The introduction of high-tech has enabled more and more external interfaces to be connected to the car network. While each external interface provides a variety of functions, it has also become a potential way for the car to be attacked, making smart connected cars more vulnerable to hacker attacks, resulting in driver personal information leakage, vehicle loss of control and other safety accidents. Therefore, smart connected cars are facing unprecedented huge security risks.

[0003] T-BOX is the only port responsible for the communication between the in-vehicle network and the external network. It has become the de facto standard for in-vehicle networks and is widely used in various cars. At the same time, almost all harmful attacks on cars involve the in-vehicle T-BOX, and the final destination of the attack is on the in-vehicle T-BOX. As one of the most intelligent components in the car, T-BOX has many basic functions and potential program vulnerabilities. T-box can communicate with the power domain, and there is a possibility of controlling the power system of the whole vehicle through T-BOX. Hackers invade T-BOX through means such as counterfeiting, eavesdropping, physical attacks, current attacks, system intrusion, and commercial leaks. Its importance is self-evident. However, since the in-vehicle T-BOX did not consider security issues too much at the beginning of its design, it is easy for the intruder to exploit it. Therefore, it is of great significance to study the intrusion detection and defense technology for the in-vehicle T-BOX in intelligent connected cars. Summary of the invention

[0004] The purpose of the present invention is to provide a T-BOX-based Internet of Vehicles intrusion detection system, which can identify or detect intrusion data, protect the safety of the vehicle-mounted T-BOX, and avoid the risk of hacker intrusion into the data center of the Internet of Vehicles.

[0005] In order to achieve the above object, the present invention is implemented through the following technical solutions:

[0006] The T-BOX-based IoV intrusion detection system includes data collection and processing modules, training modules, detection modules, and a monitoring platform;

[0007] The data acquisition and processing module includes a data acquisition function and a data processing function. The data acquisition function collects diagnostic information, vehicle operation status and other data on the CAN bus through the CAN communication module, and needs to judge the source of the data input to the system, that is, it needs to provide input interfaces facing different situations; the data processing function pre-processes the collected data and converts the data into data that can be used by the training module or the detection module, so that the data meets the input requirements of the training module or the detection module;

[0008] The training module is a prerequisite module for the detection module. The main task of the training module is to obtain a model capable of intrusion detection. The main function is to realize the training of different models for different data sets. The training module uses a model library and a parameter library. The model library includes a combination model based on ResNet and LSTM neural networks and a T-BOX attack data set with biological characteristics; the parameter library stores the weight information in the model training process and the model training effects corresponding to different parameters;

[0009] The detection module uses the model trained in the training module to detect the T-BOX data input by the system. In addition to the predicted data, it also needs to count the predicted results, while retaining the original data and the predicted results and generating corresponding evaluation indicators;

[0010] The supervision platform realizes network security anomaly monitoring functions such as real-time monitoring, vehicle dispatching, operation management, road sign signal area management, and roadbed communication equipment management.

[0011] Furthermore, the training module needs to be pre-installed with a CNN model and a RNN model.

[0012] Furthermore, a combined model based on ResNet and LSTM neural network specifically includes:

[0013] First, the collected T-BOX attack data is preprocessed and the processed data is input into the ResNet neural network. ResNet, as a pre-feature extraction unit, performs secondary processing on the data to extract useful features. Finally, the extracted features are input into the LSTM network, and LSTM, as a learning unit of time series features, outputs the final results.

[0014] Furthermore, the T-BOX attack dataset with biological characteristics specifically includes:

[0015] To introduce the driver feature recognition module, we first need to extract and process the T-BOX data, build a driver biological feature comparison library by learning the feature data, and perform feature analysis. At the same time, the combined model based on ResNet and LSTM neural networks will also predict the T-BOX data to detect whether the data is intrusion data. The prediction results of the two sub-models are integrated to obtain four final results, and the final prediction judgment can be made based on these four results.

[0016] Furthermore, the core of the T-BOX intrusion detection is to realize dynamic detection of intrusion through the evidence reasoning network, which specifically includes:

[0017] First, it is represented by a quintuple, and formula (1) is obtained:

[0018] ERN=[N,E,L,W,D] (1)

[0019] In formula (1), N refers to the set of all nodes in the wireless network environment; E refers to the set of directed edges of all nodes in the wireless network environment; L refers to the inner subset of all node vertices in the wireless network environment; W refers to the node vertex weight coefficient; D refers to the set of weaknesses in all nodes in the wireless network environment; through formula (1), the intrusion dynamic evidence is converted into a five-tuple, and then the detection is performed in the queue element. Let this objective function be q, and formula (2) can be obtained:

[0020] q={t,c,s,w} (2)

[0021] In formula (2), t refers to the timestamp; c refers to the child node pointer of the intrusion process; s refers to the state bit of the intrusion node. When the node is in the initial node state, the value is 0; when the node is in the virtual node state, the value is 1; when the node is in the intermediate node state, the value is 2; when the node is in the corresponding vertex state, the value is 3; w refers to the risk weight of intrusion dynamic detection. Through formula (2), all reverse pointers in the network environment are extracted, and then T-BOX intrusion dynamic detection is realized.

[0022] Furthermore, the weight information in the model training process specifically includes:

[0023] The optimal weight index of intrusion dynamic detection is calculated by subjective weighting method and objective weighting method. Suppose the subjective weight value of intrusion dynamic detection in the network environment is w k , we can get formula (3),

[0024]

[0025] In formula (6), m refers to the intrusion detection elasticity coefficient; r iRefers to the weight value of the i-th quantitative analysis indicator; then, the objective weight value of intrusion dynamic detection in the wireless network environment is calculated, and a higher weight is given to the indicator through objective weighting; let the objective weight value be w j , we can get formula (4),

[0026]

[0027] In formula (7), n refers to the number of standard quantitative data of intrusion dynamic detection, which is a real number. According to the obtained subjective weight value and objective weight value, the optimal weight index of intrusion dynamic detection is calculated. According to the combined weight method, p is calculated. i The specific calculation process is shown in formula (5).

[0028]

[0029] Through formula (5), we can get the optimal weight index of intrusion dynamic detection, p i The larger the value, the higher the contribution of the intrusion dynamic detection work. i The larger the value, the better the weight index for dynamic intrusion detection;

[0030] In order to ensure the real-time performance of dynamic intrusion detection in wireless network environment, the optimal weight index of dynamic intrusion detection is simplified to ensure that the dynamic intrusion detection node is always within the empirical range of Bezdek. Assuming that the equation of the simplified optimal weight index of dynamic intrusion detection is α, we have formula (6):

[0031]

[0032] In formula (6), refers to the partial derivative of intrusion dynamic detection; u refers to the regularization rate of intrusion dynamic detection; v refers to the network layer parameter in the wireless network environment. Through formula (6), the optimal weight index of intrusion dynamic detection is simplified, and the process of intrusion dynamic detection is regarded as the initialization training process of a weight parameter. A strong classifier is used to classify a large number of intrusion behavior features, which helps the trained classifier to quickly express the intrusion behavior features in detail, so that the expression results can be used as the reference standard for intrusion dynamic detection.

[0033] On this basis, the dynamic intrusion detection is realized through the calculation expression of the ReLu activation function; assuming that the expression of the dynamic intrusion detection ReLu activation function is ReLu(x), we can get formula (7):

[0034]

[0035] In formula (7), x refers to the intrusion dynamic detection result value. It can be seen from formula (7) that when x ≥ 0, non-self-intrusion can be deduced; when x < 0, the non-self-intrusion evidence chain can be traced back, thereby completing the dynamic intrusion detection in the wireless network environment.

[0036] Furthermore, the supervision platform builds an operation and management platform to realize abnormal functions such as remote monitoring, vehicle tracking, dispatch management, and route planning; combined with mobile phone APP, mobile phone text messages, and roadside display screens, it can provide users with travel service functions such as booking vehicles, vehicle positioning, and vehicle arrival reminders; based on DSRC / LTE-V communication technology, radar detection technology, and long-range wireless communication technology, combined with mobile phone APP and roadside display screens, it uses information such as the location and speed of vehicles and pedestrians to provide traffic warning services for pedestrians and test vehicles through calculations, and emergency rescue can be carried out in the event of an accident; through remote communication, the self-test function and fault alarm function of autonomous driving vehicles, traffic lights, roadside equipment, charging piles, and differential base stations can be realized, and remote control and remote monitoring and management can be carried out; real-time collection of key data of autonomous driving vehicles, charging piles, traffic lights, roadside equipment, and pedestrian speed and location information, using cloud computing and big data processing, can provide data basis for the later research on network security defense strategies for autonomous driving vehicles and research on network security control strategies for intelligent transportation.

[0037] Compared with the prior art, the beneficial effects of the present invention are:

[0038] The present invention collects diagnostic information, vehicle operation status and other data on the CAN bus through a data collection and processing module, pre-processes the collected data, converts the data into data that can be used by a training module or a detection module, obtains a model capable of intrusion detection through the training module, and implements the training of different models for different data sets. The detection module uses the trained model in the training module to detect the T-BOX data input into the system, and generates corresponding evaluation indicators. The supervision platform implements network security anomaly monitoring functions such as real-time monitoring, vehicle dispatching, operation management, road sign signal area management, and roadbed communication equipment management, so that the intrusion detection system of the present invention can identify or detect intrusion data, protect the safety of the vehicle-mounted T-BOX, and avoid the risk of hacker intrusion in the data center of the Internet of Vehicles. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Attached Figure 1 It is the overall structure diagram of the intrusion detection system of the present invention.

[0040] Attached Figure 2 It is a structural diagram of the data acquisition module of the present invention.

[0041] Attached Figure 3 It is a structural diagram of the data processing module of the present invention.

[0042] Attached Figure 4 It is a structural diagram of the training module of the present invention.

[0043] Attached Figure 5 It is a structural diagram of the detection module of the present invention.

[0044] Attached Figure 6 It is the overall topology diagram of the supervision platform of the present invention. DETAILED DESCRIPTION

[0045] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the application equally.

[0046] Embodiment: A vehicle networking intrusion detection system based on T-BOX, including a data collection and processing module, a training module, a detection module and a supervision platform;

[0047] The data acquisition and processing module includes data acquisition function and data processing function. The data acquisition function is to collect diagnostic information, vehicle operation status and other data on the CAN bus through the CAN communication module. It is necessary to determine the source of the data input into the system, that is, it is necessary to provide input interfaces for different situations. The main task of the data acquisition function is to receive the original CAN data. The source of the original CAN data is not unique, and the format of the original data may also be slightly different. This functional module needs to provide different forms of external input interfaces, for example, suitable for single-case data input manually entered by developers, suitable for text data set input for integrated data sets, or suitable for possible Bluetooth or wifi interface input, etc.; the data processing function is to pre-process the collected data and convert the data into data that can be used by the training module or the detection module, including organizing data, unifying data formats, deleting useless features and data conversion, so that the model training and data detection modules can work better, so that the data meets the input requirements of the training module or the detection module;

[0048] The training module is a prerequisite module for the detection module. The main task of the training module is to obtain a model that can perform intrusion detection. The main function is to realize the training of different models for different data sets. The selection of models and data sets can be selected through the front-end interactive interface. The module adopts a non-exclusive design, that is, the training process is carried out by creating a sub-thread, which is synchronized with the main thread of the system to realize simultaneous training of multiple models; the training module uses a model library and a parameter library, and the model library includes a combined model based on ResNet and LSTM neural networks and a T-BOX attack data set with biological characteristics. The training module also needs to pre-install a CNN model and an RNN model;

[0049] The combined model based on ResNet and LSTM neural network specifically includes:

[0050] First, the collected T-BOX attack data is preprocessed and the processed data is input into the ResNet neural network. ResNet, as a pre-feature extraction unit, performs secondary processing on the data to extract useful features. Finally, the extracted features are input into the LSTM network, and LSTM, as a learning unit of time series features, outputs the final results.

[0051] The T-BOX attack data set with biological features specifically includes:

[0052] The introduction of the driver feature recognition module and the combination model based on ResNet and LSTM neural networks make the intrusion detection model highly targeted, able to make full use of the biological features in the data set, improve the performance of the model, and have more practical application value. First, it is necessary to extract and process the T-BOX data, build a driver biological feature comparison library by learning the feature data, and perform feature analysis. At the same time, the combination model based on ResNet and LSTM neural networks will also predict the T-BOX data to detect whether the data is intrusion data. The prediction results of the two sub-models are integrated to obtain four final results, and the final prediction judgment can be made based on these four results.

[0053] The parameter library stores the weight information during the model training process and the model training effects corresponding to different parameters. The establishment of the parameter library helps to display the experimental results and optimize the model;

[0054] The weight information in the model training process specifically includes:

[0055] On the basis of extracting the state characteristics of intrusion dynamic detection, the optimal weight index of intrusion dynamic detection is calculated, and the weighted standard is used to quantify the dynamic detection data. The optimal weight index of intrusion dynamic detection is calculated by subjective weighting method and objective weighting method. According to the combined weight rule, the more important the quantitative analysis index is, the higher the order is. First, the subjective weight value of intrusion dynamic detection in the wireless network environment is calculated to determine the relative importance between adjacent quantitative analysis indicators. Suppose the subjective weight value of intrusion dynamic detection in the network environment is w k , we can get formula (3),

[0056]

[0057] In formula (6), m refers to the intrusion detection elasticity coefficient; r i Refers to the weight value of the i-th quantitative analysis indicator; then, the objective weight value of intrusion dynamic detection in the wireless network environment is calculated, and a higher weight is given to the indicator through objective weighting; let the objective weight value be w j , we can get formula (4),

[0058]

[0059] In formula (7), n refers to the number of standard quantitative data of intrusion dynamic detection, which is a real number. According to the obtained subjective weight value and objective weight value, the optimal weight index of intrusion dynamic detection is calculated. According to the combined weight method, p is calculated. i The specific calculation process is shown in formula (5).

[0060]

[0061] Through formula (5), we can get the optimal weight index of intrusion dynamic detection, p i The larger the value, the higher the contribution of the intrusion dynamic detection work. i The larger the value, the better the weight index for dynamic intrusion detection;

[0062] In order to ensure the real-time performance of dynamic intrusion detection in wireless network environment, the optimal weight index of dynamic intrusion detection is simplified to ensure that the dynamic intrusion detection node is always within the empirical range of Bezdek. Assuming that the equation of the simplified optimal weight index of dynamic intrusion detection is α, we have formula (6):

[0063]

[0064] In formula (6), refers to the partial derivative of intrusion dynamic detection; u refers to the regularization rate of intrusion dynamic detection; v refers to the network layer parameter in the wireless network environment. Formula (6) is used to simplify the optimal weight index of intrusion dynamic detection. The process of intrusion dynamic detection is regarded as the initialization training process of a weight parameter, and a strong classifier is used to classify a large number of intrusion behavior features, which helps the trained classifier to quickly express the intrusion behavior features in detail, so that the expression results can be used as the reference standard for intrusion dynamic detection.

[0065] On this basis, the dynamic intrusion detection is realized through the calculation expression of the ReLu activation function; assuming that the expression of the dynamic intrusion detection ReLu activation function is ReLu(x), we can get formula (7):

[0066]

[0067] In formula (7), x refers to the intrusion dynamic detection result value. It can be seen from formula (7) that when x ≥ 0, non-self-intrusion can be deduced; when x < 0, the non-self-intrusion evidence chain can be traced back, thereby completing the dynamic intrusion detection in the wireless network environment.

[0068] The detection module uses the model trained in the training module to detect the T-BOX data input by the system. The results of the model detection will be saved in the parameter library and transmitted to the client through the back-end API interface for display by the client. The detection module will not only record the performance of the model on the data, but also record the detection rate, detection time and other system information of the model. In addition to predicting data, the detection module also needs to statistically predict the results, retain the original data and prediction results, and generate corresponding evaluation indicators;

[0069] The supervision platform realizes network security anomaly monitoring functions such as real-time monitoring, vehicle dispatching, operation management, road sign signal area management, and roadbed communication equipment management. The supervision platform builds an operation management platform to realize abnormal functions such as remote monitoring, vehicle tracking, dispatch management, and route planning. It can provide users with travel service functions such as vehicle reservation, vehicle positioning, and vehicle arrival reminders in combination with mobile phone APP, mobile phone text messages, and roadside display screens. Based on DSRC / LTE-V communication technology, radar detection technology, and long-range wireless communication technology, combined with mobile phone APP and roadside display screens, it uses information such as the location and speed of vehicles and pedestrians to provide traffic warning services for pedestrians and test vehicles through calculations, and emergency rescue can be carried out in the event of an accident. It realizes the self-test function and fault alarm function of autonomous driving vehicles, traffic lights, roadside equipment, charging piles, and differential base stations through remote communication, and can perform remote control and remote monitoring and management. It collects key data of autonomous driving vehicles, charging piles, traffic lights, roadside equipment, and pedestrian speed and location information in real time, and uses cloud computing and big data processing to provide data basis for later research on network security defense strategies for autonomous driving vehicles and research on network security control strategies for intelligent transportation.

[0070] The core of T-BOX intrusion detection is to realize dynamic detection of intrusion through evidence reasoning network, which includes:

[0071] First, it is represented by a quintuple, and formula (1) is obtained:

[0072] ERN=[N,E,L,W,D] (1)

[0073] In formula (1), N refers to the set of all nodes in the wireless network environment; E refers to the set of directed edges of all nodes in the wireless network environment; L refers to the inner subset of all node vertices in the wireless network environment; W refers to the node vertex weight coefficient; D refers to the set of weaknesses in all nodes in the wireless network environment; through formula (1), the intrusion dynamic evidence is converted into a five-tuple, and then the detection is performed in the queue element. Let this objective function be q, and formula (2) can be obtained:

[0074] q={t,c,s,w} (2)

[0075] In formula (2), t refers to the timestamp; c refers to the child node pointer of the intrusion process; s refers to the state bit of the intrusion node. When the node is in the initial node state, the value is 0; when the node is in the virtual node state, the value is 1; when the node is in the intermediate node state, the value is 2; when the node is in the corresponding vertex state, the value is 3; w refers to the risk weight of intrusion dynamic detection. Through formula (2), all reverse pointers in the network environment are extracted, and then T-BOX intrusion dynamic detection is realized.

[0076] The present invention collects diagnostic information, vehicle operation status and other data on the CAN bus through a data collection and processing module, pre-processes the collected data, converts the data into data that can be used by a training module or a detection module, obtains a model capable of intrusion detection through the training module, and implements the training of different models for different data sets. The detection module uses the trained model in the training module to detect the T-BOX data input into the system, and generates corresponding evaluation indicators. The supervision platform implements network security anomaly monitoring functions such as real-time monitoring, vehicle dispatching, operation management, road sign signal area management, and roadbed communication equipment management, so that the intrusion detection system of the present invention can identify or detect intrusion data, protect the safety of the vehicle-mounted T-BOX, and avoid the risk of hacker intrusion in the data center of the Internet of Vehicles.

Claims

1. The vehicle networking intrusion detection system based on T-BOX is characterized by: It includes data collection and processing module, training module, detection module and supervision platform; The data acquisition and processing module includes a data acquisition function and a data processing function. The data acquisition function collects diagnostic information, vehicle operation status and other data on the CAN bus through the CAN communication module, and needs to judge the source of the data input to the system, that is, it needs to provide input interfaces facing different situations; the data processing function pre-processes the collected data and converts the data into data that can be used by the training module or the detection module, so that the data meets the input requirements of the training module or the detection module; The training module is a prerequisite module for the detection module. The main task of the training module is to obtain a model capable of intrusion detection. The main function is to realize the training of different models for different data sets. The training module uses a model library and a parameter library. The model library includes a combination model based on ResNet and LSTM neural networks and a T-BOX attack data set with biological characteristics; the parameter library stores the weight information in the model training process and the model training effects corresponding to different parameters; The detection module uses the model trained in the training module to detect the T-BOX data input by the system. In addition to the predicted data, it also needs to count the predicted results, while retaining the original data and the predicted results and generating corresponding evaluation indicators; The supervision platform realizes network security anomaly monitoring functions such as real-time monitoring, vehicle dispatching, operation management, road sign signal area management, and roadbed communication equipment management.

2. The T-BOX-based vehicle networking intrusion detection system according to claim 1 is characterized by: The training module also needs to be pre-installed with a CNN model and a RNN model.

3. The T-BOX-based vehicle networking intrusion detection system according to claim 1 is characterized by: The combined model based on ResNet and LSTM neural network specifically includes: First, the collected T-BOX attack data is preprocessed and the processed data is input into the ResNet neural network. ResNet, as a pre-feature extraction unit, performs secondary processing on the data to extract useful features. Finally, the extracted features are input into the LSTM network, and LSTM, as a learning unit of time series features, outputs the final results.

4. The T-BOX-based vehicle networking intrusion detection system according to claim 1 is characterized by: The T-BOX attack data set with biological features specifically includes: To introduce the driver feature recognition module, we first need to extract and process the T-BOX data, build a driver biological feature comparison library by learning the feature data, and perform feature analysis. At the same time, the combined model based on ResNet and LSTM neural networks will also predict the T-BOX data to detect whether the data is intrusion data. The prediction results of the two sub-models are integrated to obtain four final results, and the final prediction judgment can be made based on these four results.

5. The T-BOX-based vehicle networking intrusion detection system according to claim 1 is characterized by: The core of T-BOX intrusion detection is to realize dynamic detection of intrusion through evidence reasoning network, which includes: First, it is represented by a quintuple, and formula (1) is obtained: ERN=[N,E,L,W,D] (1) In formula (1), N refers to the set of all nodes in the wireless network environment; E refers to the set of directed edges of all nodes in the wireless network environment; L refers to the inner subset of all node vertices in the wireless network environment; W refers to the node vertex weight coefficient; D refers to the set of weaknesses in all nodes in the wireless network environment; through formula (1), the intrusion dynamic evidence is converted into a five-tuple, and then the detection is performed in the queue element. Let this objective function be q, and formula (2) can be obtained: q={t,c,s,w} (2) In formula (2), t refers to the timestamp; c refers to the child node pointer of the intrusion process; s refers to the state bit of the intrusion node. When the node is in the initial node state, the value is 0; when the node is in the virtual node state, the value is 1; when the node is in the intermediate node state, the value is 2; when the node is in the corresponding vertex state, the value is 3; w refers to the risk weight of intrusion dynamic detection. Through formula (2), all reverse pointers in the network environment are extracted, and then T-BOX intrusion dynamic detection is realized.

6. The T-BOX-based vehicle networking intrusion detection system according to claim 1 is characterized by: The weight information in the model training process specifically includes: The optimal weight index of intrusion dynamic detection is calculated by subjective weighting method and objective weighting method. Suppose the subjective weight value of intrusion dynamic detection in the network environment is w k , we can get formula (3), In formula (6), m refers to the intrusion detection elasticity coefficient; r i Refers to the weight value of the i-th quantitative analysis indicator; then, the objective weight value of intrusion dynamic detection in the wireless network environment is calculated, and a higher weight is given to the indicator through objective weighting; assuming the objective weight value is wj, formula (4) can be obtained: In formula (7), n refers to the number of standard quantitative data of intrusion dynamic detection, which is a real number. According to the obtained subjective weight value and objective weight value, the optimal weight index of intrusion dynamic detection is calculated. According to the combined weight method, p is calculated. i The specific calculation process is shown in formula (5). Through formula (5), we can get the optimal weight index of intrusion dynamic detection, p i The larger the value, the higher the contribution of the intrusion dynamic detection work. i The larger the value, the better the weight index for dynamic intrusion detection; In order to ensure the real-time performance of dynamic intrusion detection in wireless network environment, the optimal weight index of dynamic intrusion detection is simplified to ensure that the dynamic intrusion detection node is always within the empirical range of Bezdek. Assuming that the equation of the simplified optimal weight index of dynamic intrusion detection is α, we have formula (6): In formula (6), refers to the partial derivative of intrusion dynamic detection; u refers to the regularization rate of intrusion dynamic detection; v refers to the network layer parameter in the wireless network environment. Through formula (6), the optimal weight index of intrusion dynamic detection is simplified, and the process of intrusion dynamic detection is regarded as the initialization training process of a weight parameter. A strong classifier is used to classify a large number of intrusion behavior features, which helps the trained classifier to quickly express the intrusion behavior features in detail, so that the expression results can be used as the reference standard for intrusion dynamic detection. On this basis, the dynamic intrusion detection is realized through the calculation expression of the ReLu activation function; assuming that the expression of the dynamic intrusion detection ReLu activation function is ReLu(x), we can get formula (7): In formula (7), x refers to the intrusion dynamic detection result value. It can be seen from formula (7) that when x ≥ 0, non-self-intrusion can be deduced; when x < 0, the non-self-intrusion evidence chain can be traced back, thereby completing the dynamic intrusion detection in the wireless network environment.

7. The T-BOX-based Internet of Vehicles intrusion detection system according to claim 1 is characterized by: The supervision platform builds an operation management platform to realize remote monitoring, vehicle tracking, dispatch management, route planning and other abnormal functions; combined with mobile phone APP, mobile phone text messages, roadside display screens, it can provide users with travel service functions such as vehicle reservation, vehicle positioning, and vehicle arrival reminders; based on DSRC / LTE-V communication technology, radar detection technology, and long-range wireless communication technology, combined with mobile phone APP and roadside display screens, using information such as the location and speed of vehicles and pedestrians, traffic warning services are provided for pedestrians and test vehicles through calculations, and emergency rescue can be carried out if an accident occurs; Through remote communication, the self-check function and fault alarm function of autonomous driving vehicles, traffic lights, roadside equipment, charging piles, and differential base stations can be realized, and remote control and remote monitoring management can be carried out; real-time collection of key data of autonomous driving vehicles, charging piles, traffic lights, roadside equipment, and pedestrian speed and location information, using cloud computing and big data processing, can provide data basis for the later research on network security defense strategies for autonomous driving vehicles and research on network security control strategies for intelligent transportation networks.

Images