Semi-supervised in-vehicle can bus anomaly detection method and device based on dynamic graph

Abstract

The application provides a kind of semi-supervised in-vehicle CAN bus anomaly detection method and device based on dynamic graph, and relates to the technical field of anomaly detection.The method comprises: constructing an undirected time dynamic graph according to the message flow sequence and message content of the CAN bus; converting the time stamp into a time embedding vector through a time encoder, learning the low-dimensional representation of nodes and edges through a graph embedding module to obtain node embedding; predicting the anomaly score of each node according to the anomaly detection network, calculating the statistical distribution of normal nodes; further calculating the reference distribution, deviation score and deviation loss; generating a pseudo label for each node according to the deviation score, and then obtaining a trained anomaly detection model.The application proposes a semi-supervised intrusion detection method based on dynamic graph in combination with semi-supervised and graph neural network theory for network attacks received by in-vehicle CAN bus.

Description

Technical Field

[0001] This invention relates to the field of anomaly detection technology, and in particular to a semi-supervised in-vehicle CAN bus anomaly detection method and device based on dynamic graphs. Background Technology

[0002] With the development of the times, the connectivity and informatization of automobiles have become the main development direction of the Internet of Vehicles (IoV), which has greatly enriched the functions of automobiles and improved the user experience. Modern automobiles have become mobile information platforms composed of a large number of interconnected embedded subsystems. In each subsystem, the ECU (Electronic Control Unit) controls the corresponding mechanical components and interconnects with the vehicle's network (CAN, Controller Area Network, LIN, Local Interconnect Network, etc.). As automobiles become increasingly intelligent and networked, the number of electronic control units inside the vehicle is increasing, and the electronic control system is becoming increasingly complex. These on-board electronic devices and control units are also interacting more and more with the outside world. Most of these on-board devices and control units are connected to the vehicle's internal bus network, making the vehicle itself a complex network system. The on-board bus network is responsible for the information interaction between the on-board control units inside the vehicle. The control units of the vehicle's control system communicate through different bus networks, and the various bus networks are connected through gateways to form the on-board bus network system. Developed by BOSH, the CAN bus has become the most widely used vehicle bus network technology due to its advantages such as strong real-time performance, long transmission distance, strong resistance to electromagnetic interference, and low cost.

[0003] The CAN bus was not designed with information security in mind, therefore it only has basic integrity checks and lacks information security protection technologies and methods. Attackers can penetrate the vehicle's CAN bus network, which connects to critical control units, by accessing physical interfaces (such as OBD-II (On-Board Diagnostics-II), media players, etc.) or wireless access interfaces (such as Wi-Fi, Bluetooth), and send malicious attack messages through the CAN bus network to interfere with the vehicle's operation, seriously endangering the lives, property, and information safety of drivers, passengers, and other road users. Therefore, the information security of the vehicle's CAN bus network is a critical issue for the information security of connected vehicles.

[0004] The reasons for this are as follows: First, the CAN bus lacks information authentication; that is, CAN bus data frames have no address field, allowing any malicious node to impersonate a legitimate node and send messages on the bus, making it impossible for the receiving node to verify the sender's legitimacy. Second, node-transmitted data lacks encryption, making it easily vulnerable to attacks such as sniffing, spoofing, modification, and replay. Third, the CAN bus uses an ID-based arbitration mechanism, which malicious attackers can exploit to construct high-priority data frames and continuously send them to the bus, causing a DoS attack. Finally, the CAN bus has limited bandwidth; the data transmission rate of a high-speed CAN bus is only 500 kbit / s, and the maximum data payload length is only 64 bits, limiting the CAN bus protocol's ability to provide strong access control functions and making it easier for attackers to attack the ECU.

[0005] To address the aforementioned issues, researchers both domestically and internationally have conducted in-depth studies. Current in-vehicle network security solutions can be broadly categorized into three methods: message authentication, message encryption, and intrusion detection. Message authentication and encryption have proven effective for internet security and provide a certain level of in-vehicle security; however, their application in in-vehicle networks is limited by the computational performance and real-time requirements of the ECU, thus failing to effectively protect bus security. In contrast, intrusion detection methods operate passively within the vehicle, and compared to some authentication and encryption methods, they do not require changes to existing network and protocol specifications, making them a primary research direction for automotive bus intrusion detection.

[0006] The two main research directions in intrusion detection are signature-based methods and anomaly-based methods. The shortcomings of each method will be introduced and summarized below.

[0007] Signature-based anomaly detection methods extract features from datasets using known attack behaviors and design intrusion detection models. Jin et al. [Shiyi Jin, Jin-Gyun Chung, and Yinan Xu, Signature-Based Intrusion Detection System (IDS) for In-Vehicle CAN Bus Network. In 2021 IEEE International Symposium on Circuits and Systems (ISCAS), 22-28 May 2021, Daegu, Korea.] proposed a lightweight signature-based intrusion detection system, analyzing the impact of drop attacks, replay attacks, and tampering attacks on the CAN bus. To detect these attacks, the paper selected five signature types: ID, time interval, correlation, context change magnitude, and value range. For ID signatures, a whitelist mechanism was used; for context change magnitude and value range signatures, threshold statistical analysis was used; and for time interval signatures, the message arrival time interval was calculated. By simulating a real vehicle CAN bus network using CANoe software and using replay blocks to simulate different attack modes, experimental results show that the proposed IDS can effectively detect drop and replay attacks, with detection rates of 100% and 98.2%, respectively. However, for tampering attacks, the detection rate is only 66.2%.

[0008] Anomaly-based detection mechanisms model the characteristics of normal traffic on the bus, defining traffic that deviates from these characteristics as anomalous. In the current vehicular network environment, which is susceptible to various types of attacks, anomaly-based methods are more suitable for attack detection than signature-based methods due to their stable baseline characteristics. Song et al. [Hyun Min Song, Jiyoung Woo, HK Kim, “In-vehicle network intrusion detection using deepconvolutional neural network”, Vehicular Communications, vol.21, pp.100-198, 2020.] proposed an IDS (Intrusion Detection System) based on DCNN (Deep Convolutional Neural Network). DCNN learns network traffic patterns and detects malicious traffic without requiring manual feature design. Experimental results show that this IDS has a lower false negative rate and error rate compared to traditional machine learning algorithms. Han et al. [ML Han, BI Kwak, and HK Kim, “Event-triggered interval-based anomaly detection and attack identification methods for an in-vehicle network,” IEEE Trans. Inf. Forensics Security, vol. 16, pp. 2941–2956, 2021.] detected and identified anomalies in a vehicle network by utilizing the periodic event triggering intervals of CAN messages, considering different attack scenarios and three types of machine learning models. The results show that when using a tree-based machine learning model as a classifier, the proposed attack identification method can achieve an accuracy of over 94%. However, this method is only applicable to periodic events; it has limitations for non-periodic events or periodic events where the transmission rate on the bus depends on multiple variables. Summary of the Invention

[0009] To address the limitations of existing technologies, namely: 1) Signature-based anomaly detection methods cannot detect unknown or new attacks, requiring continuous updates to the list of signatures considered as attacks. Furthermore, real-time extraction of attack features on moving vehicles suffers from high latency. 2) Anomaly-based detection mechanisms typically have a high false alarm rate. To resolve these technical problems, this invention provides a semi-supervised in-vehicle CAN bus anomaly detection method and apparatus based on dynamic graphs. The technical solution is as follows:

[0010] On the one hand, a semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs is provided. This method is implemented by an in-vehicle CAN bus anomaly detection device and includes:

[0011] S1. Construct an undirected time dynamic graph based on the message flow sequence and message content of the CAN bus.

[0012] S2. The timestamps in the undirected time dynamic graph are converted into time embedding vectors by the time encoder, and the low-dimensional representations of nodes and edges in the undirected time dynamic graph are learned by the graph embedding module to obtain the node embedding of each node in the undirected time dynamic graph.

[0013] S3. Based on the node embedding and anomaly detection network of each node, predict the anomaly score of each node, record the anomaly score of each node and the time corresponding to the anomaly score through the time memory, and calculate the statistical distribution of normal nodes.

[0014] S4. Calculate the reference distribution based on the abnormal score of each node and the statistical distribution of normal nodes, calculate the deviation score based on the reference distribution, and calculate the deviation loss based on the deviation score.

[0015] S5. Generate a pseudo-label for each node based on the bias score, and train the anomaly detection model based on the bias loss and the pseudo-labels of the nodes to obtain the trained anomaly detection model.

[0016] S6. Obtain the message stream sequence and message content of the CAN bus to be detected, input them into the trained anomaly detection model, and obtain the CAN bus anomaly detection result.

[0017] Optionally, the undirected time dynamic graph in S1 is as shown in equation (1):

[0018] G = (V, E) (1)

[0019] Where G represents an undirected time-space dynamic graph, and V = v i Let E represent the set of nodes involved in all CAN message streams, where i represents the number of nodes, and E = {δ(t1), δ(t2), ..., δ(t3)}. m )) represents the message flow sequence, m represents the number of observed messages, and event δ(t) = (vi v j ,t,x ii ) indicates that at time t, from the source node v i to target node v j Message interaction occurred and was accompanied by edge feature x ij .

[0020] Optionally, the node embedding of each node in S2 is as shown in equation (2):

[0021] z i (t)=h (K) i (t) (2)

[0022] in,

[0023]

[0024] In the formula, z i (t) represents node v i The node embeddings, where i represents the number of nodes, t represents time step, K represents the number of layers in the neural network, and h (k) i (t) represents node v i The intermediate representation at time t in the k-th GNN layer, where COMBINE(·) represents the function used to combine the representations from its neighbors and the representation from the previous layer, N i Represents node v i The set of neighboring nodes at time t This indicates that during the aggregation process at time t at the k-th layer, node v i The set of neighboring nodes N i The representation of , where AGG(·) represents the aggregation function, h j (k-1) (t) represents node v j The representation of time t at the (k-1)th layer, x ij Represents node v i With node v j The associated edge features between them, φ(·) represents the relative time encoder based on cosine transform, Δt represents the relative time span between the two timestamps, v j ∈N(v i ,t) represents node v i The set of first-order adjacent nodes that occurred before t.

[0025] Optionally, in S3, based on the node embedding of each node and the anomaly detection network, an anomaly score for each node is predicted, including:

[0026] A feedforward neural network is used as an anomaly detector. The node embedding of each node is mapped to the anomaly scoring space to predict the anomaly score of each node, as shown in Equation (5) below:

[0027]

[0028] In the formula, s i (t) represents the one-dimensional anomaly score, where t represents time and i represents the number of nodes. Represents a feedforward neural network, θ a Let z represent the set of parameters for the anomaly detector. i (t) represents node v i The node embedding representation is given by ReLU(·), which represents the activation function, and W1, W2, b1, and b2 represent the learnable parameters of the anomaly detector.

[0029] Optionally, the time memory in S3 is as shown in equation (6):

[0030] m=(s i (t), t), ify i (t) = 0 or -1 or 1 (6)

[0031] In the formula, m represents the information stored in the time memory bank, and s i (t) represents the one-dimensional anomaly score, where t represents time, i represents the number of nodes, and y represents the time interval. i (t) represents node v i Label information at time t.

[0032] Optionally, in S4, the reference distribution is calculated based on the anomaly score of each node and the statistical distribution of normal nodes, as shown in equations (7)-(8) below:

[0033]

[0034] In the formula, μr(t) represents the average reference score of the statistical distribution of normal nodes at time t, and k′ represents the number of samples randomly drawn from the memory bank. t represents the weighting term for each statistical sample. i Indicates the storage time of the anomaly score, r i Let σ represent the i-th abnormal score. r (t) represents the standard deviation of the reference score of the statistical distribution of normal nodes at time t.

[0035] The deviation score is calculated based on the reference distribution, as shown in equation (9) below:

[0036]

[0037] In the formula, dev(v i,t) represents the deviation score, s i (t) represents the one-dimensional outlier score, μ r (t) represents the average reference score of the statistical distribution of normal nodes at time t, σ r (t) represents the standard deviation of the reference score of the statistical distribution of normal nodes at time t.

[0038] The deviation loss is calculated based on the deviation score, as shown in equation (10) below:

[0039] L dev =(1-y i (t))·|dev(v i ,t)|+y i (t)·max(0,m′-|dev(v i ,t)|) (10)

[0040] In the formula, L dev y represents the deviation loss. i (t) represents node v i The label information at time t, dev(v) i ,t) represents the deviation score, and m′ represents the threshold parameter.

[0041] Optionally, in S5, a pseudo-label is generated for each node based on the deviation score, including:

[0042] Calculate the deviation score distance between nodes based on the deviation score, group the nodes according to the deviation score distance, and generate a pseudo-label for each node based on the grouping results.

[0043] The supervised contrastive learning loss for nodes is shown in equation (11):

[0044]

[0045] In the formula, Let N represent the supervised contrastive learning loss, N represent the batch size of the training samples, j represent the number of nodes, and Δd represent the loss. ij z represents the fractional distance of the deviation. i (t i ) represents node v i At time t i The embedding representation of z j (t j ) represents node v j At time t j The embedded representation, where τ represents the scalar temperature parameter, k represents the number of nodes, and z k (t k ) represents node v k At time t kEmbedded representation.

[0046] On the other hand, a semi-supervised in-vehicle CAN bus anomaly detection device based on dynamic graphs is provided. This device is applied to the semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs. The device includes:

[0047] The dynamic graph construction module is used to construct an undirected time dynamic graph based on the message flow sequence and message content of the CAN bus.

[0048] The temporal graph attention network module is used to convert timestamps in an undirected temporal dynamic graph into temporal embedding vectors through a temporal encoder, and learn low-dimensional representations of nodes and edges in the undirected temporal dynamic graph through a graph embedding module, thereby obtaining the node embedding of each node in the undirected temporal dynamic graph.

[0049] The anomaly detection and time memory module is used to predict the anomaly score of each node based on the node embedding and anomaly detection network, record the anomaly score of each node and the time corresponding to the anomaly score through the time memory, and calculate the statistical distribution of normal nodes.

[0050] The deviation loss network module is used to calculate a reference distribution based on the abnormal score of each node and the statistical distribution of normal nodes, calculate the deviation score based on the reference distribution, and calculate the deviation loss based on the deviation score.

[0051] The supervised contrastive learning module generates a pseudo-label for each node based on the bias score, and trains the anomaly detection model based on the bias loss and the pseudo-labels of the nodes to obtain the trained anomaly detection model.

[0052] The output module is used to acquire the message stream sequence and message content of the CAN bus to be detected, input them into the trained anomaly detection model, and obtain the CAN bus anomaly detection result.

[0053] Alternatively, the undirected time dynamic graph is as shown in equation (1):

[0054] G = (V, E) (1)

[0055] Where G represents an undirected time-space dynamic graph, and V = v i Let E represent the set of nodes involved in all CAN message streams, where i represents the number of nodes, and E = {δ(t1), δ(t2), ..., δ(t3)}. m )) represents the message flow sequence, m represents the number of observed messages, and event δ(t) = (v i v j ,t,x ij ) indicates that at time t, from the source node v i to target node v j Message interaction occurred and was accompanied by edge feature xij .

[0056] Optionally, the node embedding of each node is as shown in equation (2):

[0057] z i (t)=h (K) i (t) (2)

[0058] in,

[0059]

[0060] In the formula, z i (t) represents node v i The node embeddings, where i represents the number of nodes, t represents time step, K represents the number of layers in the neural network, and h (k) i (t) represents node v i The intermediate representation at time t in the k-th GNN layer, where COMBINE(·) represents the function used to combine the representations from its neighbors and the representation from the previous layer, and Ni represents the representation of node v. i The set of neighboring nodes at time t This indicates that during the aggregation process at time t at the k-th layer, node v i The set of neighboring nodes N i The representation of , where AGG(·) represents the aggregation function, h j (k-1) (t) represents node v j The representation of time t at the (k-1)th layer, x ij Represents node v i With node v j The associated edge features between them, φ(·) represents the relative time encoder based on cosine transform, Δt represents the relative time span between the two timestamps, v j ∈N(v i ,t) represents node v i The set of first-order adjacent nodes that occurred before t.

[0061] Optionally, the anomaly detection and time memory module is further used for:

[0062] A feedforward neural network is used as an anomaly detector. The node embedding of each node is mapped to the anomaly scoring space to predict the anomaly score of each node, as shown in Equation (5) below:

[0063]

[0064] In the formula, s i (t) represents the one-dimensional anomaly score, where t represents time and i represents the number of nodes. Represents a feedforward neural network, θ a Let z represent the set of parameters for the anomaly detector. i (t) represents node v i The node embedding representation is given by ReLU(·), which represents the activation function, and W1, W2, b1, and b2 represent the learnable parameters of the anomaly detector.

[0065] Optionally, the time memory is as shown in equation (6):

[0066] m=(s i (t), t), ify i (t) = 0 or -1 or 1 (6)

[0067] In the formula, m represents the information stored in the time memory bank, and s i (t) represents the one-dimensional anomaly score, where t represents time, i represents the number of nodes, and y represents the time interval. i (t) represents node v i Label information at time t.

[0068] Optionally, a reference distribution is calculated based on the anomaly score of each node and the statistical distribution of normal nodes, as shown in equations (7)-(8) below:

[0069]

[0070] In the formula, μr(t) represents the average reference score of the statistical distribution of normal nodes at time t, and k′ represents the number of samples randomly drawn from the memory bank. t represents the weighting term for each statistical sample. i Indicates the storage time of the anomaly score, r i Let σ represent the i-th abnormal score. r (t) represents the standard deviation of the reference score of the statistical distribution of normal nodes at time t.

[0071] The deviation score is calculated based on the reference distribution, as shown in equation (9) below:

[0072]

[0073] In the formula, dev(v i ,t) represents the deviation score, s i (t) represents the one-dimensional outlier score, μ r (t) represents the average reference score of the statistical distribution of normal nodes at time t, σ r (t) represents the standard deviation of the reference score of the statistical distribution of normal nodes at time t.

[0074] The deviation loss is calculated based on the deviation score, as shown in equation (10) below:

[0075] L dev =(1-y i (t))·|dev(v i ,t)|+y i (t)·max(0,m′-|dev(v i ,t)|) (10)

[0076] In the formula, L dev y represents the deviation loss. i (t) represents node v i The label information at time t, dev(v) i ,t) represents the deviation score, and m′ represents the threshold parameter.

[0077] Optionally, the supervised contrastive learning module is further used for:

[0078] Calculate the deviation score distance between nodes based on the deviation score, group the nodes according to the deviation score distance, and generate a pseudo-label for each node based on the grouping results.

[0079] The supervised contrastive learning loss for nodes is shown in equation (11):

[0080]

[0081] In the formula, Let N represent the supervised contrastive learning loss, N represent the batch size of the training samples, j represent the number of nodes, and Δd represent the loss. ij z represents the fractional distance of the deviation. i (t i ) represents node v i At time t i The embedding representation of z j (t j ) represents node v j At time t j The embedded representation, where τ represents the scalar temperature parameter, k represents the number of nodes, and z k (t k ) represents node v k At time t k Embedded representation.

[0082] On the other hand, an in-vehicle CAN bus anomaly detection device is provided, the in-vehicle CAN bus anomaly detection device comprising: a processor; a memory, the memory storing computer-readable instructions, which, when executed by the processor, implement any of the methods in the above-described semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs.

[0083] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction is stored in the storage medium, the at least one instruction being loaded and executed by a processor to implement any of the above-described methods of the semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs.

[0084] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following:

[0085] This invention proposes a time-dynamic graph based on CAN message flow, which converts timestamps into time embedding vectors through a time graph attention network. As the graph embedding module continuously learns the low-dimensional representations of nodes and edges in the graph, it captures the structural features of the graph and changes in node states. This allows for the detection of CAN network attacks on real vehicles without needing to know the vehicle's CAN IDs, effectively solving the problem that in-vehicle CAN network anomaly detection depends on CAN IDs.

[0086] In real-world scenarios, anomalous samples are often scarce and difficult to obtain, leading to extreme imbalance in the dataset. This invention uses the statistical distribution of unlabeled samples as a reference distribution for loss calculation and generates corresponding pseudo-labels to participate in supervised learning. This fully utilizes the potential of unlabeled samples and effectively addresses the problem of highly imbalanced training sets that may result from the difficulty in obtaining attacked data in the real world. Attached Figure Description

[0087] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0088] Figure 1 This is a flowchart of a semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs provided in an embodiment of the present invention;

[0089] Figure 2 This is a design diagram of a semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs provided in an embodiment of the present invention;

[0090] Figure 3 This is a block diagram of a semi-supervised in-vehicle CAN bus anomaly detection device based on dynamic graphs provided in an embodiment of the present invention;

[0091] Figure 4 This is a schematic diagram of the structure of an in-vehicle CAN bus anomaly detection device provided in an embodiment of the present invention. Detailed Implementation

[0092] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0093] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0094] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, their intended meanings are consistent. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, their intended meanings are consistent.

[0095] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0096] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0097] This invention provides a semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs. This method can be implemented by an in-vehicle CAN bus anomaly detection device, which can be a terminal or a server. Figure 1 , Figure 2 The flowchart shown is a semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs. The processing flow of this method may include the following steps:

[0098] S1. Construct an undirected time dynamic graph based on the message flow sequence and message content of the CAN bus.

[0099] In one feasible implementation, dynamic graphs, compared to static graphs, can be updated over time or with changes in data, reflecting real-time data or the results of interactive operations. Compared to message sequences and static graphs, dynamic graphs can further embed message content and changes in node states over time.

[0100] Furthermore, in the anomaly detection mechanism of this invention, the dynamic diagram is represented as follows:

[0101] G = (V, E) (1)

[0102] Where G represents an undirected time-space dynamic graph, and V = v i Let E represent the set of nodes involved in all CAN message streams, where i represents the number of nodes and E is the message stream sequence. Typically, E = {δ(t1), δ(t2), ..., δ(t...}} m )) represents the message flow for generating a time-series network, where m represents the number of observed messages, and event δ(t) = (v i v j ,t,x ij ) indicates that at time t, from the source node v i to target node v j Message exchange occurred, accompanied by edge feature x. ij In this invention, edge features refer to the data fields carried in the message. Note that multiple links may exist between the same pair of node identifiers at different timestamps.

[0103] S2. The timestamps in the undirected time dynamic graph are converted into time embedding vectors by the time encoder, and the low-dimensional representations of nodes and edges in the undirected time dynamic graph are learned by the graph embedding module to obtain the node embedding of each node in the undirected time dynamic graph.

[0104] In one feasible implementation, a time-series graph encoder based on time-encoded information is used to convert timestamps into embedding vectors that reflect time periodicity and trends. These embedding vectors are then aggregated with the features of nodes and edges through a multi-layer attention mechanism to gather information from neighboring nodes, and the node feature representations are updated in conjunction with the time encoding.

[0105] Specifically, in dynamic graphs, node embeddings should include not only static node features (such as inherent node properties) but also node features and topological structures that evolve over time. This temporal graph attention network module is used to identify node embeddings as cosine functions with respect to time and to inductively infer and observe node embeddings as the graph changes.

[0106] The temporal graph attention network mainly consists of two key parts: a temporal encoding module and a graph embedding module. The temporal encoder converts timestamps into temporal embedding vectors using a cosine periodic function; these vectors capture the periodicity and trend of time. The graph embedding module is responsible for learning low-dimensional representations of nodes and edges in the graph, which capture the structural features of the graph and its dynamic characteristics over time. This module consists of multiple GNN (Graph Neural Network) layers that take a graph G constructed at time t as input and feed all v in G through a message-passing mechanism. i Extracting node representation z i (t). Formally, the forward propagation of the k-th layer is described as follows:

[0107]

[0108] In the formula, z i (t) represents node v i The node embeddings, where i represents the number of nodes, t represents time step, K represents the number of layers in the neural network, and h (k) i (t) represents node v i The intermediate representation at time (timestamp) t in the k-th GNN layer, where COMBINE(·) represents the function used to combine the representations from its neighbors and the representation from the previous layer, N i Represents node v i The set of neighboring nodes at time t, these neighboring nodes are those in graph G that are related to node v. i Directly connected nodes This indicates that during the aggregation process at time t at the k-th layer, node v i The set of neighboring nodes N i The representation, AGG(·), indicates an aggregation function used to propagate and aggregate messages from neighbors, h j (k-1) (t) represents node v j The representation (or embedding) of x at time t in the (k-1)th layer ij Represents node v i With node v j The associated edge features between them, φ(·) represents a relative time encoder based on cosine transform. φ(·) converts time information into a set of vectors that can represent time features, which helps to capture periodic patterns on dynamic graphs, Δt=tt ij t represents the relative time span between two timestamps. ij Represents an edge (v) i v j The timestamp added to the graph, v j ∈N(v i ,t) represents node v i The set of first-order adjacent nodes that occurred before node t. Finally, node v can be obtained. i Node embedding: z i (t)=h (K) i (t).

[0109] S3. Based on the node embedding and anomaly detection network of each node, predict the anomaly score of each node, record the anomaly score of each node and the time corresponding to the anomaly score through the time memory, and calculate the statistical distribution of normal nodes.

[0110] In one feasible implementation, the encoded data is fed into an anomaly detection network, which is responsible for predicting the anomaly score for each node. Simultaneously, the IDS employs a temporal memory database to record the predicted anomaly score and the temporal information of each node.

[0111] Optionally, in S3, based on the node embedding of each node and the anomaly detection network, an anomaly score for each node is predicted, including:

[0112] To distinguish between abnormal and normal samples, this invention introduces an anomaly detector, which embeds the learned nodes into z... i (t) is mapped to an anomaly rating space, where normal samples are clustered and anomaly samples deviate from the set. Specifically, this invention uses a simple feedforward neural network. As an anomaly detector:

[0113]

[0114] In the formula, s i (t) represents the one-dimensional anomaly score, where t represents time and i represents the number of nodes. Represents a feedforward neural network, θ a Let z represent the set of parameters for the anomaly detector. i (t) represents node v i The node embedding representation is given by , where ReLU(·) represents the activation function, and W1, W2, b1, and b2 represent the learnable parameters of the anomaly detector. Within the framework of this invention, s i (t) is a one-dimensional outlier score with values ​​ranging from -∞ to +∞. Ideally, outlier scores of normal samples will cluster within a specific interval, and outliers (outliers) can be easily identified based on the overall distribution of outlier scores.

[0115] Furthermore, based on the assumption that most unlabeled data are normally distributed samples, this invention generates this distribution by using a time-based memory to record historical outlier scores of the samples. The messages that need to be stored in the memory are described below:

[0116] m = s i (t), ify i (t) = 0 or -1 or 1 (5)

[0117] Among them, y i (t) represents node v iThe label information at time point t has values ​​of -1, 0, and 1, representing that the node is an unlabeled sample, a normal sample, or an abnormal sample at the current time point, respectively. Since the attributes of nodes in the dynamic graph are constantly evolving, the labels and abnormal scores also change accordingly. Furthermore, samples with longer time intervals should have a smaller impact on the current statistical distribution; therefore, this invention also records the time t corresponding to each abnormal score in the time memory database.

[0118] m=(s i (t), t), ify i (t) = 0 or -1 or 1 (6)

[0119] Meanwhile, the time memory is designed as a first-in, first-out queue of size M. Because outdated samples have little gain on model parameter changes during model training, the time memory controls the queue size by discarding sufficiently old samples.

[0120] S4. Calculate the reference distribution based on the abnormal score of each node and the statistical distribution of normal nodes, calculate the deviation score based on the reference distribution, and calculate the deviation loss based on the deviation score.

[0121] In one feasible implementation, the information generated through steps S2-S3 is used to generate the statistical distribution of normal samples as prior knowledge, and the bias loss is calculated to guide the subsequent learning of the network.

[0122] Specifically, this invention uses the bias loss [Guansong Pang, Chunhua Shen, and Anton vanden Hengel. Deep anomaly detection with deviation networks. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD 2019, Anchorage, AK, USA, August 4-8, 2019, pages 353-362, 2019.] as the primary learning objective. Its purpose is to enable the model to distinguish between normal and abnormal nodes. The bias loss is calculated by comparing the anomalous score of each node with the statistical distribution of normal samples stored in the memory bank.

[0123] Furthermore, based on the assumption that the distribution of outlier scores follows a Gaussian distribution, this invention randomly selects a sample of size Ms from the time memory to calculate the reference score. To improve the robustness of the model, random perturbations are added to the experiments. Simultaneously, this invention introduces the effect of time decay, utilizing the time stamp t and the outlier score storage time t... i The weighting term for each statistical sample is calculated based on the relative time span between them. The average μ of the reference scores at time point t in the normal sample statistical distribution r (t) and standard deviation σ r (t) is calculated as follows:

[0124]

[0125] In the formula, μ r (t) represents the average reference score of the normal node's statistical distribution at time t, and k′ represents the number of samples randomly drawn from the memory. These samples are used to calculate the reference score (including the mean μ) at time t. r (t) and standard deviation σ r (t)), t represents the weighting term for each statistical sample. i Indicates the storage time of the anomaly score, r i Let σ represent the i-th abnormal score. r (t) represents the standard deviation of the reference score of the statistical distribution of normal nodes at time point t.

[0126] Furthermore, the bias score measures the prediction anomaly score s of a node at time t. i (t) and the statistical distribution of the normal sample scores in the memory bank (mean μ) r (t) and standard deviation σ r The standardized deviation between (t) and (t). The formula for calculating the deviation score is as follows:

[0127]

[0128] In the formula, dev(v i ,t) represents the deviation score, s i (t) represents the one-dimensional outlier score, μ r (t) represents the average reference score of the statistical distribution of normal nodes at time point t, σ r (t) represents the standard deviation of the reference score of the statistical distribution of normal nodes at time point t.

[0129] Furthermore, for each node v i The deviation score dev(v) at time t i ,t) was used to calculate the deviation loss Ldev L dev It is a contrastive loss, and its goal is to optimize the model parameters. It takes into account the node's label information y. i (t), if the node is a normal node (y i If (t) = 0, then the loss function encourages the bias score to be close to 0; if the node is an outlier (y i If (t) = 1, then the loss function encourages the bias score to move away from 0. The formula for calculating the bias loss is as follows:

[0130] L dev =(1-y i (t))·|dev(v i ,t)|+y i (t)·max(0,m′-|dev(v i ,t)|) (10)

[0131] In the formula, L dev y represents the deviation loss. i (t) represents node v i The label information at time point t, dev(v) i ,t) represents the bias score, and m′ represents the threshold parameter, which is equivalent to the Z-Score confidence interval.

[0132] Furthermore, by minimizing the bias loss, the node representations learned by the model will make the anomaly scores of normal samples approximate the distribution of normal samples in the temporal memory, while the anomaly scores of abnormal samples will deviate from this distribution. In this way, the model can effectively detect abnormal nodes in dynamic graphs.

[0133] S5. Generate a pseudo-label for each node based on the bias score, and train the anomaly detection model based on the bias loss and the pseudo-labels of the nodes to obtain the trained anomaly detection model.

[0134] In one feasible implementation, to further utilize the potential of large amounts of unlabeled data, the framework of this invention introduces a novel pseudo-label contrastive learning module. This module uses predicted outlier scores to generate pseudo-labels for nodes by calculating the score distance between nodes—nodes that are closer together will be grouped into the same pseudo-group and assigned the same label, and nodes within the same pseudo-group will form positive sample pairs for contrastive learning.

[0135] Specifically, in order to fully utilize the potential of unlabeled samples, this invention is based on the existing bias score dev(v i For each sample, generate a pseudo-label y. i(t), and incorporate them into the training of the graph encoder network. Here, the present invention designs a supervised contrastive learning task by calculating the bias fractional distance Δd between sample pairs. ij =|dev(v i , t i )-dev(v j , t j Grouping is performed. If the distance between the bias scores of two samples is less than one standard deviation, they are grouped into the same group and considered similar. Based on the assumption that similar samples should have similar feature representations, nodes with closer bias scores have more similar node representations, while nodes with greater differences in bias scores have greater differences in representation. The goal of this task is consistent with the bias loss of this invention, which separates the differences between normal and abnormal samples in both the representation space and the abnormal score space. Therefore, for a single sample v i Its supervised contrastive learning loss is:

[0136]

[0137] In the formula, This represents the supervised contrastive learning loss, where N represents the number of samples in the batch training samples (i.e., the batch size), j represents the number of nodes, and Δd ij z represents the fractional distance of the deviation. i (t i ) represents node v i At time t i The embedding representation of z j (t j ) represents node v j At time t j The embedded representation, where τ represents the scalar temperature parameter used to control the sensitivity of the loss function, k represents the number of nodes, and z k (t k ) represents node v k At time t k Embedded representation, This is an indicator function that is 1 when the deviation score distance between two samples is less than 1, and 0 otherwise.

[0138] This classification (grouping) is based on the similarity between samples, rather than on predefined category labels. This approach is particularly suitable for semi-supervised learning scenarios, where utilizing unlabeled data is crucial for improving model performance.

[0139] S6. Obtain the message stream sequence and message content of the CAN bus to be detected, input them into the trained anomaly detection model, and obtain the CAN bus anomaly detection result.

[0140] In this embodiment of the invention, a time dynamic graph based on CAN message flow is proposed, which converts timestamps into time embedding vectors through a time graph attention network. As the graph embedding module continuously learns the low-dimensional representations of nodes and edges in the graph, it captures the structural features of the graph and changes in node states. This allows for the detection of CAN network attacks on real vehicles without needing to know the vehicle's CAN IDs, effectively solving the problem that in-vehicle CAN network anomaly detection depends on CAN IDs.

[0141] In real-world scenarios, anomalous samples are often scarce and difficult to obtain, leading to extreme imbalance in the dataset. This invention uses the statistical distribution of unlabeled samples as a reference distribution for loss calculation and generates corresponding pseudo-labels to participate in supervised learning. This fully utilizes the potential of unlabeled samples and effectively addresses the problem of highly imbalanced training sets that may result from the difficulty in obtaining attacked data in the real world.

[0142] Figure 3 This is a block diagram illustrating a dynamic graph-based semi-supervised in-vehicle CAN bus anomaly detection device according to an exemplary embodiment. The device is used in a dynamic graph-based semi-supervised in-vehicle CAN bus anomaly detection method. (Refer to...) Figure 3 The device includes a dynamic graph construction module 310, a temporal graph attention network module 320, an anomaly detection and temporal memory module 330, a bias loss network module 340, a supervised contrastive learning module 350, and an output module 360. Among them:

[0143] The dynamic graph construction module 310 is used to construct an undirected time dynamic graph based on the message flow sequence and message content of the CAN bus.

[0144] The temporal graph attention network module 320 is used to convert timestamps in an undirected temporal dynamic graph into temporal embedding vectors through a temporal encoder, and learn low-dimensional representations of nodes and edges in the undirected temporal dynamic graph through a graph embedding module to obtain the node embedding of each node in the undirected temporal dynamic graph.

[0145] The anomaly detection and time memory module 330 is used to predict the anomaly score of each node based on the node embedding and anomaly detection network of each node, record the anomaly score of each node and the time corresponding to the anomaly score through the time memory, and calculate the statistical distribution of normal nodes.

[0146] The deviation loss network module 340 is used to calculate a reference distribution based on the abnormal score of each node and the statistical distribution of normal nodes, calculate the deviation score based on the reference distribution, and calculate the deviation loss based on the deviation score.

[0147] The supervised contrastive learning module 350 is used to generate a pseudo-label for each node based on the bias score, and to train the anomaly detection model based on the bias loss and the pseudo-label of the node, thus obtaining the trained anomaly detection model.

[0148] The output module 360 ​​is used to acquire the message stream sequence and message content of the CAN bus to be detected, input them into the trained anomaly detection model, and obtain the CAN bus anomaly detection result.

[0149] In this embodiment of the invention, a time dynamic graph based on CAN message flow is proposed, which converts timestamps into time embedding vectors through a time graph attention network. As the graph embedding module continuously learns the low-dimensional representations of nodes and edges in the graph, it captures the structural features of the graph and changes in node states. This allows for the detection of CAN network attacks on real vehicles without needing to know the vehicle's CAN IDs, effectively solving the problem that in-vehicle CAN network anomaly detection depends on CAN IDs.

[0150] In real-world scenarios, anomalous samples are often scarce and difficult to obtain, leading to extreme imbalance in the dataset. This invention uses the statistical distribution of unlabeled samples as a reference distribution for loss calculation and generates corresponding pseudo-labels to participate in supervised learning. This fully utilizes the potential of unlabeled samples and effectively addresses the problem of highly imbalanced training sets that may result from the difficulty in obtaining attacked data in the real world.

[0151] Figure 4 This is a schematic diagram of the structure of an in-vehicle CAN bus anomaly detection device provided in an embodiment of the present invention, as shown below. Figure 4 As shown, the in-vehicle CAN bus anomaly detection device may include the above-mentioned Figure 3 The illustrated device is a semi-supervised in-vehicle CAN bus anomaly detection device based on dynamic graphs. Optionally, the in-vehicle CAN bus anomaly detection device 410 may include a first processor 2001.

[0152] Optionally, the in-vehicle CAN bus anomaly detection device 410 may also include a memory 2002 and a transceiver 2003.

[0153] The first processor 2001, memory 2002, and transceiver 2003 can be connected via a communication bus.

[0154] The following is combined Figure 4 A detailed description of each component of the in-vehicle CAN bus anomaly detection device 410 is provided below:

[0155] The first processor 2001 is the control center of the in-vehicle CAN bus anomaly detection device 410. It can be a single processor or a collective term for multiple processing elements. For example, the first processor 2001 can be one or more central processing units (CPUs), application-specific integrated circuits (ASICs), or one or more integrated circuits configured to implement embodiments of the present invention, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0156] Optionally, the first processor 2001 can perform various functions of the in-vehicle CAN bus anomaly detection device 410 by running or executing software programs stored in the memory 2002 and calling data stored in the memory 2002.

[0157] In a specific implementation, as one example, the first processor 2001 may include one or more CPUs, for example... Figure 4 CPU0 and CPU1 are shown in the diagram.

[0158] In a specific implementation, as one example, the in-vehicle CAN bus anomaly detection device 410 may also include multiple processors, for example... Figure 4 The first processor 2001 and the second processor 2004 are shown in the diagram. Each of these processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). Here, "processor" can refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0159] The memory 2002 is used to store the software program that executes the present invention, and is controlled by the first processor 2001 to execute it. The specific implementation method can be referred to the above method embodiment, and will not be repeated here.

[0160] Optionally, the memory 2002 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 2002 may be integrated with the first processor 2001 or may exist independently, and may be connected via the interface circuit of the in-vehicle CAN bus anomaly detection device 410. Figure 4 (Not shown in the figure) is coupled to the first processor 2001, and the embodiments of the present invention do not specifically limit this.

[0161] The transceiver 2003 is used to communicate with network devices or with terminal devices.

[0162] Alternatively, transceiver 2003 may include a receiver and a transmitter. Figure 4 (Not shown separately). The receiver is used to implement the receiving function, and the transmitter is used to implement the sending function.

[0163] Optionally, the transceiver 2003 can be integrated with the first processor 2001, or it can exist independently and be connected via the interface circuit of the in-vehicle CAN bus anomaly detection device 410. Figure 4 (Not shown in the figure) is coupled to the first processor 2001, and the embodiments of the present invention do not specifically limit this.

[0164] It should be noted that, Figure 4 The structure of the in-vehicle CAN bus anomaly detection device 410 shown does not constitute a limitation on the router. Actual knowledge structure identification devices may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0165] Furthermore, the technical effect of the in-vehicle CAN bus anomaly detection device 410 can be referred to the technical effect of the semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs described in the above method embodiments, and will not be repeated here.

[0166] It should be understood that the first processor 2001 in this embodiment of the invention may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0167] It should also be understood that the memory in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0168] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0169] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0170] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0171] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0172] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0173] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0174] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0175] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0176] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0177] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0178] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs, characterized in that, The method includes: S1. Construct an undirected time dynamic graph based on the message flow sequence and message content of the CAN bus; S2. The timestamps in the undirected time dynamic graph are converted into time embedding vectors by a time encoder, and the low-dimensional representations of nodes and edges in the undirected time dynamic graph are learned by a graph embedding module to obtain the node embedding of each node in the undirected time dynamic graph. S3. Based on the node embedding and anomaly detection network of each node, predict the anomaly score of each node, record the anomaly score of each node and the time corresponding to the anomaly score through a time memory, and calculate the statistical distribution of normal nodes. S4. Calculate a reference distribution based on the abnormal score of each node and the statistical distribution of normal nodes, calculate a deviation score based on the reference distribution, and calculate a deviation loss based on the deviation score. S5. Generate a pseudo-label for each node based on the deviation score, and train an anomaly detection model based on the deviation loss and the pseudo-label of the node to obtain a trained anomaly detection model. S6. Obtain the message stream sequence and message content of the CAN bus to be detected, input them into the trained anomaly detection model, and obtain the CAN bus anomaly detection result; The step S5, which generates a pseudo-label for each node based on the deviation score, includes: Calculate the deviation score distance between nodes based on the deviation score, group the nodes based on the deviation score distance, and generate a pseudo-label for each node based on the grouping result. The supervised contrastive learning loss for nodes is shown in equation (11): In the formula, Let N represent the supervised contrastive learning loss, N represent the batch size of the training samples, and j represent the number of nodes. Let Δd be an indicator function. ij z represents the fractional distance of the deviation. i (t i ) represents node v i At time t i The embedding representation of z j (t j ) represents node v j At time t j The embedded representation, where τ represents the scalar temperature parameter, k represents the number of nodes, and z k (t k ) represents node v k At time t k Embedded representation.

2. The semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs according to claim 1, characterized in that, The undirected time dynamic graph in S1 is shown in equation (1) below: G=(V,E) (1) Where G represents an undirected time-space dynamic graph, and V = v i Let E represent the set of nodes involved in all CAN message streams, where i represents the number of nodes, and E = {δ(t1), δ(t2), ..., δ(t...}. m )} represents the message flow sequence, m represents the number of observed messages, and event δ(t) = (v i ,v j ,t,x ij ) indicates that at time t, from the source node v i to target node v j Message interaction occurred and was accompanied by edge feature x ij .

3. The semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs according to claim 1, characterized in that, The node embedding of each node in S2 is shown in equation (2) below: z i (t)=h (K) i (t) (2) where, In the formula, z i (t) represents node v i The node embeddings are defined as follows: i represents the number of nodes, t represents time step, K is the number of layers in the neural network, and h... (k) i (t) represents node v i The intermediate representation at time t in the k-th GNN layer, where COMBINE(·) represents the function used to combine the representations from its neighbors and the representation from the previous layer, N i Represents node v i The set of neighboring nodes at time t This indicates that during the aggregation process at time t at the k-th layer, node v i The set of neighboring nodes N i The representation of , where AGG(·) represents the aggregation function, h j (k-1) (t) represents node v j The representation of time t at the (k-1)th layer, x ij Represents node v i With node v j The associated edge features between them, φ(·) represents the relative time encoder based on cosine transform, Δt represents the relative time span between the two timestamps, v j ∈N(v i ,t) represents node v i The set of first-order adjacent nodes that occurred before t.

4. The semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs according to claim 1, characterized in that, The step S3, which predicts the anomaly score for each node based on its node embedding and the anomaly detection network, includes: A feedforward neural network is used as an anomaly detector. The node embedding of each node is mapped to the anomaly scoring space to predict the anomaly score of each node, as shown in the following equation (5): In the formula, s i (t) represents the one-dimensional anomaly score, where t represents time and i represents the number of nodes. Represents a feedforward neural network, θ a Let z represent the set of parameters for the anomaly detector. i (t) represents node v i The node embedding representation is given by ReLU(·), which represents the activation function, and W1, W2, b1, and b2 represent the learnable parameters of the anomaly detector.

5. The semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs according to claim 1, characterized in that, The time memory bank in S3 is shown in the following formula (6): m=(s i (t),t),if y i (t)=0 or-1 or 1 (6) In the formula, m represents the information stored in the time memory bank, and s i (t) represents the one-dimensional anomaly score, where t represents time, i represents the number of nodes, and y represents the time interval. i (t) represents node v i In the label information at time t, -1, 0, and 1 represent that the node is an unlabeled sample, a normal sample, or an abnormal sample at the current time point, respectively.

6. The semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs according to claim 1, characterized in that, The reference distribution in S4 is calculated based on the abnormal score of each node and the statistical distribution of normal nodes, as shown in equations (7)-(8) below: In the formula, μ r (t) represents the average reference score of the statistical distribution of normal nodes at time t, and k′ represents the number of samples randomly drawn from the memory bank. t represents the weighting term for each statistical sample. i Indicates the storage time of the anomaly score, r i Let σ represent the i-th abnormal score. r (t) represents the standard deviation of the reference score of the statistical distribution of normal nodes at time t; The deviation score is calculated based on the reference distribution, as shown in equation (9) below: In the formula, dev(v i ,t) represents the deviation score, s i (t) represents the one-dimensional outlier score, μ r (t) represents the average reference score of the statistical distribution of normal nodes at time t, σ r (t) represents the standard deviation of the reference score of the statistical distribution of normal nodes at time t; The deviation loss is calculated based on the deviation score, as shown in equation (10) below: L dev =(1-y i (t))·|dev(v i ,t)|+y i (t)·max(0,m′-|dev(v i ,t)|) (10) In the formula, L dev y represents the deviation loss. i (t) represents node v i The label information at time t, dev(v) i ,t) represents the deviation score, and m′ represents the threshold parameter.

7. A semi-supervised in-vehicle CAN bus anomaly detection device based on dynamic graphs, wherein the semi-supervised in-vehicle CAN bus anomaly detection device based on dynamic graphs is used to implement the semi-supervised in-vehicle CAN bus anomaly detection method based on dynamic graphs as described in any one of claims 1-6, characterized in that, The device includes: The dynamic graph construction module is used to construct an undirected time dynamic graph based on the message flow sequence and message content of the CAN bus. The temporal graph attention network module is used to convert timestamps in the undirected temporal dynamic graph into temporal embedding vectors through a temporal encoder, and to learn low-dimensional representations of nodes and edges in the undirected temporal dynamic graph through a graph embedding module, thereby obtaining the node embedding of each node in the undirected temporal dynamic graph. The anomaly detection and time memory module is used to predict the anomaly score of each node based on the node embedding of each node and the anomaly detection network, record the anomaly score of each node and the time corresponding to the anomaly score through the time memory, and calculate the statistical distribution of normal nodes. The deviation loss network module is used to calculate a reference distribution based on the abnormal score of each node and the statistical distribution of normal nodes, calculate a deviation score based on the reference distribution, and calculate a deviation loss based on the deviation score. The supervised contrastive learning module is used to generate a pseudo-label for each node based on the bias score, and to train an anomaly detection model based on the bias loss and the pseudo-label of the node to obtain a trained anomaly detection model. The output module is used to acquire the message stream sequence and message content of the CAN bus to be detected, input them into the trained anomaly detection model, and obtain the CAN bus anomaly detection result.

8. An in-vehicle CAN bus anomaly detection device, characterized in that, The in-vehicle CAN bus anomaly detection device includes: processor; A memory storing computer-readable instructions that, when executed by the processor, implement the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium contains program code that can be invoked by a processor to execute the method as described in any one of claims 1 to 6.

Images