T-box based vehicle networking intrusion detection system

Abstract

The application discloses a T-BOX-based vehicle networking intrusion detection system and mainly relates to the field of vehicle network protection. The system comprises a data acquisition and processing module, a training module, a detection module and a supervision platform. The data acquisition and processing module comprises a data acquisition function and a data processing function. The data acquisition function needs to provide input interfaces for different situations. The data processing function is used for preprocessing the collected data. The main task of the training module is to obtain a model capable of performing intrusion detection. The detection module is used for detecting T-BOX data input by the system by using the trained model in the training module and generating corresponding evaluation indexes. The supervision platform realizes real-time monitoring, vehicle scheduling and other network security anomaly monitoring functions. The application has the beneficial effects that intrusion data can be identified or detected, vehicle T-BOX safety is protected, and the risk that a data center of vehicle networking is subjected to hacker intrusion is avoided.

Description

TECHNICAL FIELD

[0001] The application relates to the field of vehicle network protection, and particularly relates to a T-BOX-based vehicle network intrusion detection system. BACKGROUND

[0002] With the rapid development of Internet technology, various high-techs are gradually used in automobiles, and intelligent networked vehicles begin to enter the public's vision. However, the intelligent networked vehicles, while providing many convenient functions and good driving experiences, also bring more security risks. The use of high-techs makes more and more external interfaces connected to the automobile network, and each external interface, while providing diversified functions, also becomes a potential way for the automobile to be attacked, so that the intelligent networked vehicle is more likely to be subjected to hacker attacks, thereby causing the leakage of the driver's personal information, vehicle out-of-control and other safety accidents. Therefore, the intelligent networked vehicle is facing unprecedented great security risks.

[0003] The T-BOX is the only interface responsible for the communication between the in-vehicle network and the out-vehicle network, has become the actual standard of the vehicle network and is widely used in various automobiles. At the same time, almost all attacks against automobiles involve the vehicle-mounted T-BOX, and the final landing point of the attack is on the vehicle-mounted T-BOX. As one of the most intelligent components in the vehicle, the T-BOX has many basic functions and many potential program vulnerabilities. The T-BOX can communicate with the power domain, and there is a possibility of controlling the whole vehicle power system through the T-BOX. Hackers can invade the T-BOX by means of impersonation and deception, eavesdropping data, physical attack, current attack, system intrusion, commercial espionage and the like, and the importance of the T-BOX is self-evident. However, the vehicle-mounted T-BOX does not consider security problems too much at the beginning of design, so the vehicle-mounted T-BOX is easy to become the object of the intruder. Therefore, it is of great significance to study the intrusion detection and defense technology for the vehicle-mounted T-BOX in the intelligent networked vehicle. SUMMARY

[0004] The application aims to provide a T-BOX-based vehicle network intrusion detection system which can identify or detect intrusion data, protect the safety of the vehicle-mounted T-BOX and avoid the risk of hacker intrusion into the data center of the vehicle network.

[0005] In order to achieve the above-mentioned purpose, the application realizes the following technical scheme:

[0006] The T-BOX-based vehicle network intrusion detection system comprises a data acquisition and processing module, a training module, a detection module and a supervision platform.

[0007] The data acquisition and processing module includes a data acquisition function and a data processing function. The data acquisition function collects diagnostic information and vehicle operating state data on the CAN bus through the CAN communication module. The data input into the system needs to be judged for its source, i.e., an input interface needs to be provided for different situations. The data processing function is to preprocess the collected data, convert the data into data that can be used by the training module or the detection module, and make the data meet the input requirements of the training module or the detection module.

[0008] The training module is a prerequisite for the detection module. The main task of the training module is to obtain a model capable of intrusion detection. The main function is to train different models on different data sets. The training module uses a model library and a parameter library. The model library includes a combination model based on ResNet and LSTM neural networks and a T-BOX attack data set with biological characteristics. The parameter library stores weight information during model training and the model training effect corresponding to different parameters.

[0009] The detection module uses the trained model in the training module to detect T-BOX data input into the system. In addition to predicting data, it also needs to count the prediction results, retain the original data and prediction results, and generate corresponding evaluation indicators.

[0010] The supervision platform realizes real-time monitoring, vehicle scheduling, operation management, road sign signal area management, roadbed communication equipment management, and other network security anomaly monitoring functions.

[0011] Further, the training module also needs to pre-embed a CNN model and an RNN model.

[0012] Further, the combination model based on ResNet and LSTM neural networks specifically includes:

[0013] First, the collected T-BOX attack data is preprocessed, and the processed data is input into the ResNet neural network. ResNet, as a pre-feature extraction unit, processes the data again, extracts useful features, and finally inputs the extracted features into the LSTM network. LSTM, as a time series feature learning unit, outputs the final result.

[0014] Further, the T-BOX attack data set with biological characteristics specifically includes:

[0015] The driver feature recognition module needs to extract and process the T-BOX data first, learn the feature data to build a driver biological feature comparison library, and perform feature analysis. At the same time, the combination model based on ResNet and LSTM neural network also predicts the T-BOX data to detect whether the data is intrusion data. The prediction results of the two sub-models are fused with each other to obtain four types of final results, and the final prediction judgment can be made based on the four types of results.

[0016] Further, the core of the T-BOX intrusion detection is to realize dynamic detection of intrusion through an evidence reasoning network, specifically including:

[0017] First, it is represented by a five-tuple, and formula (1) is obtained:

[0018] ERN = [N, E, L, W, D] (1)

[0019] In formula (1), N refers to the set of all nodes in the wireless network environment; E refers to the set of all node directed edges in the wireless network environment; L refers to the internal subset of all node vertices in the wireless network environment; W refers to the node vertex weight coefficient; D refers to the set of weak points in all nodes in the wireless network environment; through formula (1), the dynamic evidence of intrusion is converted into a five-tuple, and then detection is performed in the queue element. Set the objective function as q, and formula (2) is obtained:

[0020] q = {t, c, s, w} (2)

[0021] In formula (2), t refers to the time stamp; c refers to the sub-node pointer of the intrusion process; s refers to the state bit of the node under the intrusion, which takes the value 0 when the node is in the initial node state, takes the value 1 when the node is in the virtual node state, takes the value 2 when the node is in the intermediate node state, and takes the value 3 when the node is in the corresponding vertex state; w refers to the risk weight of the dynamic intrusion detection; through formula (2), all reverse pointers in the network environment are extracted, and the T-BOX intrusion dynamic detection is realized.

[0022] Further, the weight information in the model training process specifically includes:

[0023] The optimal weight index of the intrusion dynamic detection is calculated by the subjective weighting method and the objective weighting method. Set the subjective weight value of the intrusion dynamic detection in the network environment as w k , and formula (3) is obtained,

[0024]

[0025] In formula (6), m refers to the intrusion detection elasticity coefficient; r iThe weight value of the i-th quantitative analysis index is referred to as wi; then, the objective weight value of the intrusion dynamic detection in the wireless network environment is calculated, and the index is given a higher weight through objective weighting; the objective weight value is set as w j The formula (4) can be obtained,

[0026]

[0027] In formula (7), n refers to the number of intrusion dynamic detection standard quantitative data, which is a real number; the optimal weight index of intrusion dynamic detection is calculated according to the subjective weight value and the objective weight value; p is calculated according to the combination weight method i The value of the numerical value is specifically calculated as shown in formula (5),

[0028]

[0029] The optimal weight index p of intrusion dynamic detection can be obtained through formula (5), i The greater the value is, the higher the contribution degree of the intrusion dynamic detection work is. The greater the value is, the higher the optimal weight index of intrusion dynamic detection is; i

[0030] To ensure the real-time performance of the intrusion dynamic detection in the wireless network environment, the optimal weight index of intrusion dynamic detection is simplified to ensure that the intrusion dynamic detection node is always within the experience range of Bezdek. The equation of the simplified optimal weight index of intrusion dynamic detection is set as a, and formula (6) is obtained,

[0031]

[0032] In formula (6), The partial derivative of the intrusion dynamic detection is referred to as u, the regularization rate of the intrusion dynamic detection is referred to as v, and the network layer parameter in the wireless network environment is referred to as w. Through formula (6), the optimal weight index of intrusion dynamic detection is simplified. The process of intrusion dynamic detection is regarded as an initialization training process of a weight parameter, and a strong classifier is used to classify a large number of intrusion behavior characteristics. The trained classifier can quickly express the intrusion behavior characteristics in detail, so that the expression result is used as a reference standard for intrusion dynamic detection;

[0033] On this basis, the intrusion dynamic detection is realized through the calculation expression of the ReLu activation function. The ReLu activation function expression of the intrusion dynamic detection is set as ReLu(x), and formula (7) is obtained,

[0034]

[0035] ​In formula (7), x refers to an intrusion dynamic detection result value, and it can be deduced that it is a non-self intrusion when x is greater than or equal to 0, and it can be traced back to a non-self intrusion evidence chain when x is less than 0, so as to complete the intrusion dynamic detection in the wireless network environment.

[0036] Further, the supervision platform builds an operation management platform to realize remote monitoring, vehicle tracking, dispatch management, path planning and other abnormal functions; in combination with a mobile phone APP, mobile phone short messages and a roadside display screen, the user can be provided with travel service functions such as vehicle reservation, vehicle positioning and arrival reminding; based on DSRC / LTE-V communication technology, radar detection technology and remote wireless communication technology, in combination with a mobile phone APP and a roadside display screen, the position and speed of vehicles and pedestrians are used to provide traffic warning services for pedestrians and test vehicles through calculation, such as emergency rescue in the event of an accident; through remote communication, the self-checking function and fault alarm function of an automatic driving vehicle, a traffic signal lamp, a roadside device, a charging pile and a differential base station can be realized, remote control and remote monitoring management can be performed; real-time collection of key data of an automatic driving vehicle, a charging pile, a traffic signal lamp, a roadside device and the speed and position of pedestrians and the use of cloud computing and big data processing can provide data basis for the research of network security defense strategies of automatic driving vehicles and intelligent traffic network security control strategies.

[0037] Compared with the prior art, the present application has the following advantages:

[0038] The data acquisition and processing module of the present application acquires diagnostic information on the CAN bus, vehicle operating state and other data, and pre-processes the acquired data to convert the data into data that can be used by the training module or the detection module, acquires a model capable of intrusion detection through the training module, trains different models on different data sets, uses the trained model in the training module to detect the T-BOX data input by the detection module, and generates corresponding evaluation indexes, so that the supervision platform realizes real-time monitoring, vehicle dispatching, operation management, road sign area management, roadbed communication equipment management and other network security anomaly monitoring functions, so that the intrusion detection system of the present application can identify or detect intrusion data, protect the safety of the vehicle-mounted T-BOX, and avoid the risk of hacker intrusion into the data center of the Internet of Vehicles. BRIEF DESCRIPTION OF DRAWINGS

[0039] FIG. 1 is a schematic diagram of the intrusion detection system of the present application. Figure 1 is a schematic diagram of the intrusion detection system of the present application.

[0040] FIG. 3 is a schematic diagram of the data acquisition module of the present application. Figure 2 is a schematic diagram of the data acquisition module of the present application.

[0041] FIG. 5 is a schematic diagram of the data processing module of the present application. Figure 3 is a schematic diagram of the data processing module of the present application.

[0042] Figure 2 is a schematic diagram of a training module of the application. Figure 4 Figure 3 is a schematic diagram of a detection module of the application.

[0043] Figure 4 is a schematic diagram of a data acquisition and processing module of the application. Figure 5 Figure 5 is a schematic diagram of a supervision platform of the application.

[0044] Figure 6 is a schematic diagram of a data acquisition and processing module of the application. Figure 6 Figure 7 is a schematic diagram of a supervision platform of the application. DETAILED DESCRIPTION

[0045] The application will be further described below in connection with specific embodiments. It should be understood that these embodiments are only used to illustrate the application and not used to limit the scope of the application. Furthermore, it should be understood that those skilled in the art can make various modifications or changes to the application after reading the content of the application, and these equivalent forms also fall within the scope of the application.

[0046] Embodiment: T-BOX-based vehicle networking intrusion detection system, including a data acquisition and processing module, a training module, a detection module, and a supervision platform.

[0047] The data acquisition and processing module includes a data acquisition function and a data processing function. The data acquisition function collects diagnostic information and vehicle operating state data on the CAN bus through the CAN communication module. The data needs to be judged for its source, i.e., an input interface needs to be provided for different situations. The main work of the data acquisition function is to receive raw CAN data. The source of the raw CAN data is not unique, and the format of the original data may also have slight differences. This function module needs to provide different forms of input interfaces to the outside, such as singleton data input for manual input by developers, text data set input for integrated data sets, or Bluetooth or wifi interface input that may exist, etc. The data processing function is to preprocess the collected data and convert the data into data that can be used by the training module or the detection module, including data arrangement, data format unification, deletion of useless features, and data conversion, etc. so that the model training and data detection module can work better, so that the data meets the input requirements of the training module or the detection module.

[0048] The training module is a prerequisite module of the detection module, and the main task of the training module is to obtain a model capable of intrusion detection, and the main function is to realize training of different models on different data sets, and the selection of the model and the data set can be selected through a front-end interactive interface, and the module adopts a non-exclusive design, that is, the training process is performed through the creation of a sub-thread, and is synchronized with the system main thread, so that multiple models can be trained simultaneously; the training module uses a model library and a parameter library, the model library includes a combination model based on ResNet and LSTM neural networks and a T-BOX attack data set with biological characteristics, and the training module also needs to pre-embed a CNN model and an RNN model;

[0049] The combination model based on ResNet and LSTM neural networks specifically includes:

[0050] First, the collected T-BOX attack data is preprocessed, and the processed data is input into the ResNet neural network, ResNet is used as a pre-feature extraction unit to perform secondary processing on the data, and useful features are extracted, and finally the extracted features are input into the LSTM network, and the LSTM is used as a time series feature learning unit to output the final result.

[0051] The T-BOX attack data set with biological characteristics specifically includes:

[0052] The driver feature recognition module is introduced, and the combination model based on ResNet and LSTM neural networks is combined, so that the intrusion detection model has strong pertinence, can fully utilize the biological characteristics in the data set, improve the performance of the model, and has more practical application value, first, the T-BOX data needs to be extracted and processed, the feature data is learned to build a driver biological feature comparison library, and feature analysis is performed. At the same time, the combination model based on ResNet and LSTM neural networks also predicts the T-BOX data, detects whether the data is intrusion data. The prediction results of the two sub-models are fused with each other, and four types of final results are obtained, and based on the four types of results, the final prediction judgment can be performed.

[0053] The parameter library stores the weight information in the model training process, and the model training effect corresponding to different parameters, and the establishment of the parameter library is helpful to display the experimental results and optimize the model;

[0054] The weight information in the model training process specifically includes:

[0055] On the basis of extracting intrusion dynamic detection state characteristics, the optimal weight index of intrusion dynamic detection is calculated, the dynamic detection data is quantified by weighting standard, the optimal weight index of intrusion dynamic detection is calculated by subjective weighting method and objective weighting method, according to the combination weight rule, the more important quantitative analysis index is arranged in the front, first, the subjective weight value of intrusion dynamic detection in wireless network environment is calculated, so as to determine the relative importance between adjacent quantitative analysis indexes, and the subjective weight value of intrusion dynamic detection in network environment is w k , formula (3) can be obtained,

[0056]

[0057] In formula (6), m represents the intrusion detection elasticity coefficient; r i represents the weight value of the i-th quantitative analysis index; then, the objective weight value of intrusion dynamic detection in wireless network environment is calculated, and the index is given higher weight by objective weighting; the objective weight value is w j , formula (4) can be obtained,

[0058]

[0059] In formula (7), n represents the number of intrusion dynamic detection standard quantitative data, which is a real number; according to the obtained subjective weight value and objective weight value, the optimal weight index of intrusion dynamic detection is calculated; the value of p i is calculated according to the combination weight method, and the specific calculation process is shown in formula (5),

[0060]

[0061] Through formula (5), the optimal weight index of intrusion dynamic detection p i is obtained, the greater the value, the higher the contribution degree of the intrusion dynamic detection work, and the greater the value of p i is, the optimal weight index of intrusion dynamic detection;

[0062] In order to ensure the real-time of intrusion dynamic detection in wireless network environment, the optimal weight index of intrusion dynamic detection is simplified, and the intrusion dynamic detection node is always in the experience range of Bezdek, the equation of simplified optimal weight index of intrusion dynamic detection is α, then formula (6) is obtained,

[0063]

[0064] In formula (6), The dynamic detection of intrusion refers to the partial derivative; u refers to the regularization rate of the dynamic detection of intrusion; v refers to the network layer parameter in the wireless network environment, the optimal weight index of the dynamic detection of intrusion is simplified through formula (6), the process of the dynamic detection of intrusion is regarded as an initialization training process of a weight parameter, and a strong classifier is used for classification of a large number of intrusion behavior characteristics, so that the trained classifier can quickly express the intrusion behavior characteristics in detail, and thus the expression result is taken as a reference standard of the dynamic detection of intrusion;

[0065] On this basis, the dynamic detection of intrusion is realized through the calculation expression of the ReLu activation function; the ReLu activation function expression of the dynamic detection of intrusion is ReLu(x), and formula (7) is obtained,

[0066]

[0067] In formula (7), x refers to the result value of the dynamic detection of intrusion, and it can be deduced that it is a non-self intrusion when x is greater than or equal to 0 according to formula (7), and it can be traced back to the evidence chain of the non-self intrusion when x is less than 0, so as to complete the dynamic detection of intrusion in the wireless network environment.

[0068] The detection module uses the trained model in the training module to detect the T-BOX data input by the system, the result of model detection is saved in the parameter library, and is also transmitted to the client through the API interface of the back end, for display by the client. The detection module not only records the performance of the model on the data, but also records the detection rate, detection time and other system information of the model. In addition to predicting data, the detection module also needs to count the prediction results, and retains the original data and the prediction results and generates corresponding evaluation indexes;

[0069] The aforementioned monitoring platform enables real-time monitoring, vehicle dispatching, operation management, road sign and signal area management, and roadside communication equipment management, among other network security anomaly monitoring functions. The platform also establishes an operation management platform for remote monitoring, vehicle tracking, dispatch management, and route planning. Combined with a mobile app, SMS messages, and roadside displays, it provides users with travel services such as vehicle reservation, vehicle location, and arrival reminders. Based on DSRC / LTE-V communication technology, radar detection technology, and remote wireless communication technology, and utilizing vehicle and pedestrian location and speed information, it provides traffic warning services to pedestrians and test vehicles, enabling emergency rescue in case of accidents. Through remote communication, it enables self-checking and fault alarm functions for autonomous vehicles, traffic lights, roadside equipment, charging piles, and differential base stations, allowing for remote control and monitoring management. Real-time collection of key data from autonomous vehicles, charging piles, traffic lights, roadside equipment, and pedestrian speed and location information, processed using cloud computing and big data, provides data support for future research on autonomous vehicle network security defense strategies and intelligent transportation network security control strategies.

[0070] The core of the T-BOX intrusion detection is to achieve dynamic detection of intrusions through an evidence reasoning network, specifically including:

[0071] First, we can express it using a quintuple, which gives us formula (1):

[0072] ERN=[N,E,L,W,D] (1)

[0073] In formula (1), N refers to the set of all nodes in the wireless network environment; E refers to the set of directed edges of all nodes in the wireless network environment; L refers to the inner subset of all nodes' vertices in the wireless network environment; W refers to the node vertex weight coefficient; D refers to the set of weaknesses in all nodes in the wireless network environment. Through formula (1), the dynamic evidence of intrusion is converted into a quintuple, and then detection is performed in the queue elements. Let the objective function be q, then formula (2) can be obtained:

[0074] q={t,c,s,w} (2)

[0075] In formula (2), t refers to the timestamp; c refers to the child node pointer of the intrusion process; s refers to the status bit of the node under intrusion, which is 0 when the node is in the initial node state; 1 when the node is in the virtual node state; 2 when the node is in the intermediate node state; and 3 when the node is in the corresponding vertex state; w refers to the risk weight of dynamic intrusion detection. Through formula (2), all reverse pointers in the network environment are extracted, thereby realizing T-BOX dynamic intrusion detection.

[0076] The application collects diagnostic information on the CAN bus, vehicle operating state and other data through a data acquisition and processing module, and pre-processes the collected data to convert the data into data that can be used by a training module or a detection module, obtains a model capable of intrusion detection through the training module, trains different models on different data sets, detects the T-BOX data input by the system through the detection module using the trained model in the training module, and generates corresponding evaluation indexes, realizes real-time monitoring, vehicle scheduling, operation management, road identification signal area management, roadbed communication equipment management and other network security anomaly monitoring functions through a supervision platform, so that the intrusion detection system of the application can identify or detect intrusion data, protect the safety of the vehicle-mounted T-BOX, and avoid the risk of hacker intrusion into the data center of the Internet of Vehicles.

Claims

1. A vehicle-to-everything (V2X) intrusion detection system based on T-BOX, characterized in that: It includes a data acquisition and processing module, a training module, a detection module, and a monitoring platform; The data acquisition and processing module includes data acquisition and data processing functions. The data acquisition function collects diagnostic information and vehicle operating status data on the CAN bus through the CAN communication module. It needs to determine the source of the data input to the system, that is, it needs to provide input interfaces for different situations. The data processing function preprocesses the acquired data, transforming it into data that can be used by the training module or the detection module, so that the data meets the input requirements of the training module or the detection module. The training module is a prerequisite module for the detection module. The task of the training module is to acquire a model capable of intrusion detection. Its function is to train different models on different datasets. The training module uses a model library and a parameter library. The model library includes a combined model based on ResNet and LSTM neural networks and a T-BOX attack dataset with biological features. The parameter library stores the weight information during the model training process and the model training effect corresponding to different parameters. The detection module uses the model trained in the training module to detect the T-BOX data input to the system. In addition to predicting the data, it also needs to statistically analyze the prediction results, while retaining the original data and prediction results and generating corresponding evaluation indicators. The monitoring platform enables real-time monitoring, vehicle dispatching, operation management, road sign and signal area management, roadbed communication equipment management, and network security anomaly monitoring.

2. The vehicle network intrusion detection system based on T-BOX according to claim 1, characterized in that: The training module also needs to be pre-loaded with CNN and RNN models.

3. The vehicle network intrusion detection system based on T-BOX according to claim 1, characterized in that: The combined model based on ResNet and LSTM neural networks specifically includes: First, the collected T-BOX attack data is preprocessed. The processed data is then input into a ResNet neural network. ResNet acts as a pre-feature extraction unit to perform secondary processing on the data and extract useful features. Finally, the extracted features are input into an LSTM network, which acts as a learning unit for time series features and outputs the final result.

4. The vehicle network intrusion detection system based on T-BOX according to claim 1, characterized in that: The biologically-featured T-BOX attack dataset specifically includes: The introduction of a driver feature recognition module first requires the extraction and processing of T-BOX data. By learning the feature data, a driver biological feature comparison library is constructed and feature analysis is performed. At the same time, a combined model based on ResNet and LSTM neural networks will also predict the T-BOX data and detect whether the data is intrusive. The prediction results of the two sub-models are fused together to obtain four types of final results, and the final prediction and judgment can be made based on these four types of results.

5. The vehicle network intrusion detection system based on T-BOX according to claim 1, characterized in that: The core of the T-BOX intrusion detection is to achieve dynamic detection of intrusions through an evidence reasoning network, specifically including: First, we can express it using a quintuple, which gives us formula (1): ERN=[N,E,L,W,D] (1) In formula (1), N refers to the set of all nodes in the wireless network environment; E refers to the set of directed edges of all nodes in the wireless network environment; L refers to the inner subset of all nodes' vertices in the wireless network environment; W refers to the node vertex weight coefficient; D refers to the set of weaknesses in all nodes in the wireless network environment. Through formula (1), the dynamic evidence of intrusion is converted into a quintuple, and then detection is performed in the queue elements. Let the objective function be q, then formula (2) can be obtained: q={t,c,s,w} (2) In formula (2), t refers to the timestamp; c refers to the child node pointer of the intrusion process; s refers to the status bit of the node under intrusion, which is 0 when the node is in the initial node state; 1 when the node is in the virtual node state; 2 when the node is in the intermediate node state; and 3 when the node is in the corresponding vertex state; w refers to the risk weight of dynamic intrusion detection. Through formula (2), all reverse pointers in the network environment are extracted, thereby realizing T-BOX dynamic intrusion detection.

6. The vehicle network intrusion detection system based on T-BOX according to claim 1, characterized in that: The weight information during the model training process specifically includes: The optimal weight index for dynamic intrusion detection is calculated using both subjective and objective weighting methods. Let w be the subjective weight value for dynamic intrusion detection in a network environment. k Formula (3) can be obtained. In formula (3), m refers to the intrusion detection elasticity coefficient; r i This refers to the weight value of the i-th quantitative analysis indicator; then, the objective weight value of intrusion dynamic detection in the wireless network environment is calculated, and the indicator is given a higher weight through objective weighting; let the objective weight value be w. j Formula (4) can be obtained. In formula (4), n refers to the number of quantitative data points for dynamic intrusion detection, which is a real number; based on the obtained subjective and objective weight values, the optimal weight index for dynamic intrusion detection is calculated; p is calculated using the combined weight method. i The numerical value and the specific calculation process are shown in formula (5). Using formula (5), the optimal weight index for dynamic intrusion detection, p, can be obtained. i A higher value indicates a greater contribution to the dynamic intrusion detection work, with p... i The larger the value, the more optimal the weighting index for dynamic intrusion detection; To ensure the real-time performance of dynamic intrusion detection in a wireless network environment, the optimal weight index for dynamic intrusion detection is simplified to ensure that the dynamic intrusion detection node is always within Bezdek's empirical range. Let the equation for the simplified optimal weight index for dynamic intrusion detection be α, then we have formula (6). In formula (6), , refers to the partial derivative of dynamic detection of intrusion; u refers to the dynamic detection regularization rate of intrusion; v refers to the network layer parameter in the wireless network environment. By formula (6), the optimal weight index of dynamic detection of intrusion is reduced, and the process of dynamic detection of intrusion is regarded as the initialization training process of a weight parameter. A strong classifier is used to classify a large number of intrusion behavior features, which helps the trained classifier to quickly make a detailed expression of the intrusion behavior features, so as to use the expression result as the reference standard for dynamic detection of intrusion. Based on this, intrusion dynamic detection is achieved through the calculation expression of the ReLU activation function; let the ReLU activation function expression for intrusion dynamic detection be ReLU(x), then formula (7) can be obtained. In formula (7), x refers to the result value of dynamic intrusion detection. According to formula (7), when x≥0, non-self intrusion can be deduced; when x<0, the evidence chain of non-self intrusion can be traced back, thereby completing dynamic intrusion detection in the wireless network environment.

7. The vehicle network intrusion detection system based on T-BOX according to claim 1, characterized in that: The aforementioned monitoring platform establishes an operation and management platform to realize remote monitoring, vehicle tracking, dispatch management, and route planning anomaly functions; combined with a mobile APP, SMS, and roadside display screen, it can provide users with services such as vehicle reservation, vehicle location, and arrival reminders; based on DSRC / LTE-V communication technology, radar detection technology, and remote wireless communication technology, combined with a mobile APP and roadside display screen, it uses the location and speed information of vehicles and pedestrians to provide traffic warning services for pedestrians and test vehicles through calculation, and can carry out emergency rescue in case of accidents. By enabling self-testing and fault alarm functions for autonomous vehicles, traffic lights, roadside equipment, charging piles, and differential base stations through remote communication, remote control and monitoring management can be achieved. Real-time collection of key data from autonomous vehicles, charging piles, traffic lights, roadside equipment, and pedestrian speed and location information, combined with cloud computing and big data processing, can provide data support for future research on cybersecurity defense strategies for autonomous vehicles and cybersecurity control strategies for intelligent transportation networks.

Images