A can bus flow anomaly detection method based on unsupervised deep learning

Abstract

The application provides a CAN bus flow anomaly detection method based on unsupervised deep learning, and data training and detection are performed through a designed neural network model.The method comprises the following steps: 1) generating an attack test set, collecting and preprocessing CAN bus data, and designing an injection attack method; 2) constructing a neural network comprising a feature embedding module, a time series decomposition module, a feature enhancement module and a prediction reconstruction module; 3) training the model, inputting the collected normal CAN bus data into the neural network, and taking the reconstruction error of the output sequence and the input sequence as a loss function to train; and 4) detecting data, inputting the collected test set data into the trained model, outputting an abnormal score, and regarding data with a high score as abnormal and data with a low score as normal.The method provided by the application can effectively identify abnormal flow in the CAN bus, can detect unknown attack types, and has the advantages of high running efficiency, good accuracy and the like.

Description

Technical Field

[0001] This invention relates to the field of vehicle information security, and in particular to a method for detecting abnormal CAN bus traffic based on unsupervised deep learning. Background Technology

[0002] Existing research on vehicle bus IDS can be divided into three categories based on the methods used: rule-based methods, methods based on supervised machine learning models, and methods based on unsupervised machine learning models.

[0003] (M. Müter and N. Asaj, "Entropy-based anomaly detection for in-vehicle networks," in 2011 IEEE Intelligent Vehicles Symposium (IV), 2011, pp. 1110-1115: IEEE.) and (H. Olufowobi, C. Young, J. Zambreno, and G. Bloom, "SAIDuCANT: Specification-based automotive intrusion detection using controller area network (CAN) timing," IEEE Transactions on Vehicular Technology, vol. 69, no. 2, pp. 1484-1494, 2019.) employed statistical analysis methods based on high-dimensional entropy and data frequency for IDS research; (V. Tanksale, "Intrusion detection for controller area network using support vector machines," presented at the 2019 IEEE 16th international conference on mobile ad hoc and sensor systems workshops (MASSW), 2019.) used machine learning models such as support vector machines (SVM) to analyze data features. These statistical analysis methods and machine learning models typically employ fixed feature extraction patterns, designing analysis models based on vehicle bus rules. Therefore, they are highly interpretable and simple to implement. However, fixed feature extraction patterns cannot effectively capture the complexity of attacks, are difficult to adapt to the needs of different scenarios, and their accuracy and detection capabilities are insufficient to meet the requirements of modern vehicles for Intrusion Detection Systems (IDS). In recent research, researchers are increasingly favoring the use of deep learning models to extract features and classify data traffic.(P. Cheng, M. Han, A. Li, and FJI JoIS Zhang, "STC-IDS: Spatial–temporal correlation feature analyzing based intrusion detection system for intelligent connected vehicles," vol. 37, no. 11, pp. 9532-9561, 2022.) converts vehicle traffic flow into a two-dimensional binary matrix and extracts spatial features of vehicle traffic flow based on a convolutional neural network (CNN) model; (AR Javed, S. Ur Rehman, MU Khan, M. Alazab, and T. Reddy, "CANintelliIDS: Detecting in-vehicle intrusion attacks on a controller area network using CNN and attention-based GRU," IEEE transactions on network science engineering, vol. 8, no. 2, pp. 1456-1466, 2021.) further combines the self-attention mechanism with a gated recurrent unit (GRU) model to extract more valuable features and improve detection accuracy.

[0004] The methods described above are all based on supervised learning models, and most of them achieve high anomaly detection accuracy on datasets with known attack types. However, these models are limited in that they can only defend against known attack types present in the training dataset and cannot cope with unknown attacks. In contrast, unsupervised learning models only require normal data for training and do not need to include attack data, thus exhibiting greater robustness in detecting unknown attacks. (S. Zhuo, Nuo Li, and Kui Ren, "HistCAN: A Real-time CAN IDS with Enhanced Historical Traffic Learning Capability.") A hybrid autoencoder was constructed by combining CNN and Multilayer Perceptron (MLP) to detect anomaly scores by reconstructing the input sequence and analyzing the correlation between the original sequence and the reconstructed sequence. Although autoencoder-based CAN IDS meets the requirements of unsupervised training, simple CNN or MLP networks are insufficient to extract complex time-series information from vehicular traffic data messages. Research has found that models based on time-series predictive analysis are more suitable for feature analysis of vehicular network traffic data. The literature (A. Taylor, S. Leblanc, and N. Japkowicz, "Anomaly detection in automobile control network data with long short-term memory networks," in 2016 IEEE International Conference on Data Science and Advanced Analytics (DSAA), 2016, pp. 130-139: IEEE) uses LSTM to predict future sequences for intrusion detection; (H. Sun, M. Chen, J. Weng, Z. Liu, and G. Geng, "Anomaly detection for in-vehicle network using CNN-LSTM with attention mechanism," IEEE Transactions on Vehicular Technology, vol. 70, no. 10, pp. 10880-10893, 2021.) further combines LSTM and attention mechanisms for time series prediction. However, the performance of LSTM is still insufficient to fully capture the long-term sequence information of in-vehicle bus messages; while the attention mechanism of neural networks poses greater challenges to hardware and inference time, making it difficult to meet the actual needs of intelligent connected vehicles. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by providing a method for detecting abnormal CAN bus traffic based on unsupervised deep learning.

[0006] The objective of this invention is achieved through the following technical solution: a CAN bus traffic anomaly detection method based on unsupervised deep learning, comprising the following steps:

[0007] (1) Generate CAN bus attack test set: Collect vehicle CAN bus traffic data, perform data preprocessing, and use it as a training set; design CAN bus message injection attack method, perform injection attack in real vehicle, and collect data as CAN injection test set.

[0008] (2) Construct an unsupervised deep learning anomaly detection model, including a feature embedding module, a temporal decomposition module, a feature enhancement module, and a prediction reconstruction module; wherein, the feature embedding module is used to convert the CAN bus data sequence into a one-dimensional temporal feature vector that the model can train; the temporal decomposition module is used to decompose the temporal feature vector into multiple periodic components, and generate a two-dimensional feature map through a fast Fourier transform layer and a linear fully connected layer; the feature enhancement module is used to extract high-dimensional features from the two-dimensional feature map, and realize the feature first increasing and then decreasing in dimensionality through a multi-layer convolutional neural network; the prediction reconstruction module is used to convert the high-dimensional features into a one-dimensional prediction sequence, and generate a prediction result with the same length as the input sequence through a flattening layer and a fully connected layer;

[0009] (3) Train the unsupervised deep learning anomaly detection model: Input the CAN bus data training set collected in step (1) into the unsupervised deep learning anomaly detection model designed in step (2), and use the reconstruction error of the output sequence and the input sequence as the loss function and anomaly score to train the model;

[0010] (4) Detect CAN bus traffic data: Input the CAN bus data test set collected in step (1) into the model trained in step (3), output the abnormal score, and judge whether the data is abnormal by comparing the abnormal score and the threshold. If there is abnormal data, trigger an alarm.

[0011] Further, step (1) includes the following sub-steps:

[0012] (1.1) Collect vehicle CAN bus data packets under normal conditions; obtain several CAN bus binary data frame groups under different vehicle operating conditions, i.e. training set; replay one of the groups on the vehicle CAN bus in the original order and observe whether the vehicle generates a corresponding response under no other operation.

[0013] (1.2) If the vehicle does not respond to the replay operation in step (1.1), it means that the operation cannot be injected as an attack data frame; if there is a response, the data frame group is divided into two groups in the middle in sequence, and injected into the vehicle to observe whether there is a response. The group that responds is selected as the data frame group for the next injection.

[0014] (1.3) Repeat the steps of grouping, replaying, and observing the response in step (1.2) until the remaining data frame group contains only one single data frame, which is the data frame that can be injected with the attack; inject this data frame into the vehicle CAN bus at a certain time interval, and at the same time collect the CAN bus traffic data to obtain the attack dataset under this data frame injection.

[0015] (1.4) Repeat the above steps for the data frame groups collected by different operations in step (1.1) to obtain multiple sets of CAN bus attack datasets under different data frame injection, i.e. test sets.

[0016] Furthermore, step (2) includes the following sub-steps:

[0017] (2.1) Based on the CAN bus data obtained in step (1), input the feature embedding module to obtain a one-dimensional feature vector that the model can train; the feature embedding module consists of a feature encoder and a position encoder; the feature encoder is a single-layer linear fully connected network used to convert shallow low-dimensional CAN traffic into deep multi-dimensional time-series features; the position encoder uses a combination of sine and cosine functions to map the position information of each data frame to a two-dimensional space, giving strong correlation to data with close time distance and weak correlation to data with far time distance; the outputs of the two encoders are directly added together to obtain the output vector of the feature embedding module;

[0018] (2.2) Based on the temporal feature vector obtained in step (2.1), input it into the temporal decomposition module to obtain a two-dimensional feature map; the temporal decomposition module consists of a fast Fourier transform layer and multiple linear fully connected layers in parallel. The result vector of the feature embedding module in step (2.1) is input into the fast Fourier transform layer to obtain multiple periods contained in the sequence. The original sequence is decomposed into vector groups of different lengths and numbers according to the k different time periods with the strongest intensity. Each vector group is input into the corresponding fully connected layer according to the different periods. The output vector is added with a new dimension and parallel operation is performed to obtain a two-dimensional feature map;

[0019] (2.3) Based on the two-dimensional feature map obtained in step (2.2), the input feature enhancement module is used to obtain high-dimensional features. The feature enhancement module consists of two convolutional neural networks. The first layer contains a 4-channel convolutional layer with kernel sizes of 1x1, 3x3, 5x5, and 7x7 for each channel. The convolution stride is 1 for each channel. The number of channels after convolution becomes one-quarter of the original feature map. The boundary padding of the convolution ensures that the size of the two-dimensional feature map remains unchanged. After each channel is convolved, the layers are stacked according to the channel dimension of the output feature map to form a high-dimensional feature map with four times the number of input channels. The result of the first layer convolution is processed by GeLU activation and then input into the second layer. The second layer has the same convolutional structure as the first layer, with the number of input channels being four times the original number of channels and the number of output channels being one times the original number of channels, forming an inverse residual structure to complete feature enhancement. The output of the convolutional layer is processed by GeLU activation as the result of the enhancement module.

[0020] (2.4) Based on the high-dimensional features obtained in step (2.3), input them into the prediction reconstruction module to obtain the prediction sequence; the prediction reconstruction module consists of a flattening layer and a fully connected layer. The flattening layer is used to convert the high-dimensional feature map into a one-dimensional feature vector, and the fully connected layer aligns the length of the feature vector with the input vector to generate the prediction sequence; the prediction sequence output by the prediction reconstruction module is the output data of the model.

[0021] Furthermore, step (3) includes the following sub-steps:

[0022] (3.1) Process the data packets collected in step (1), extract the ID of the CAN data as the first feature, process the timestamp of the CAN data, extract the time interval between adjacent CAN frames as the second feature, extract the time interval between CAN frames with the same ID as the third feature, and merge the three features of each CAN frame into the feature vector of each time point of the time series.

[0023] (3.2) Window the feature vectors obtained in step (3.1), draw a window every 100 frames, and slide a new window every time. Input the feature vector sequence of 100 frames in a window into the model designed in step (2) to obtain the output sequence. Calculate the root mean square error between the output prediction vector sequence and the next window of the input sequence, and use it as the loss function for model training. Use the backpropagation algorithm to train the model.

[0024] (3.3) Calculate the root mean square error value of each window of the training set obtained by inference on the optimal model in step (3.2), and calculate the average to obtain the anomaly score threshold of this training set.

[0025] Furthermore, the specific process of step (4) is as follows:

[0026] The CAN bus data is collected in real time using the method in step (1). The collected data is processed into feature vectors in units of windows as in step (3.1). These feature vectors are then input into the model after training in step (3.2). The root mean square error of the output predicted sequence feature vector and the next window vector of the input vector is calculated to obtain the abnormality score of the window. The obtained abnormality score is compared with the abnormality score threshold obtained in step (3.3). If the score is higher than the threshold, it indicates that the window contains abnormal data. If the score is lower than the threshold, it indicates that the window contains normal data. If multiple consecutive windows contain abnormal data, it indicates that there is a significant abnormality in the data flow, and the system will issue an alarm.

[0027] To achieve the above objectives, the present invention also provides a CAN bus traffic anomaly detection device based on unsupervised deep learning, comprising one or more processors for implementing the above-described CAN bus traffic anomaly detection method based on unsupervised deep learning.

[0028] To achieve the above objectives, the present invention also provides an electronic device, including a memory and a processor, wherein the memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the above-described CAN bus traffic anomaly detection method based on unsupervised deep learning.

[0029] To achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method for detecting abnormal CAN bus traffic based on unsupervised deep learning.

[0030] The beneficial effects of this invention are that by constructing a CAN bus intrusion detection model using unsupervised deep learning technology, real-time monitoring and anomaly identification of vehicle CAN bus data are achieved, significantly reducing the need for manual intervention. This method is the first to propose an unsupervised learning intrusion detection method for CAN bus, which effectively identifies potential attack behaviors and provides early warning of unknown attack patterns without the need for training with abnormal data, while ensuring high detection accuracy similar to supervised learning. It achieves real-time and efficient intrusion detection of a large amount of CAN bus data, and its performance is superior to existing technologies, with wide applicability and transferability. Attached Figure Description

[0031] Figure 1 This is an overall structural diagram of the CAN bus anomaly detection model designed by the method of this invention;

[0032] Figure 2 This is a schematic diagram of the structure of the device of the present invention;

[0033] Figure 3 This is a schematic diagram of an electronic device according to the present invention. Detailed Implementation

[0034] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.

[0035] The present invention will now be described in detail with reference to the accompanying drawings. Unless otherwise specified, the features of the following embodiments and implementations can be combined with each other.

[0036] The core technology of this invention is to design a CAN (Controller Area Network) bus anomaly detection model based on unsupervised deep learning, and to realize a dataset generation, model training and anomaly detection method, so as to achieve an efficient, accurate CAN bus traffic anomaly detection method with unknown attack identification capability.

[0037] See Figure 1 This invention proposes a method for detecting abnormal CAN bus traffic based on unsupervised deep learning, comprising the following steps:

[0038] (1) Generate CAN bus attack test set: Based on the normal CAN bus traffic data of a real vehicle, perform data preprocessing to use as a training set; design a CAN bus message injection attack method, perform the injection attack on a real vehicle, and collect data as a CAN injection test set; specifically including the following sub-steps:

[0039] (1.1) Selection of injection attack frames: Collect vehicle CAN bus data packets under normal conditions; design experimental operations, select several electronic control units (ECUs) that may transmit data on the CAN bus, perform relevant operations on the vehicle and collect binary data frames under the operation state to obtain several data frame traffic groups containing individual operations, i.e., training sets; replay one of the groups completely on the vehicle CAN bus in the original order and observe whether the vehicle generates a response to the corresponding operation;

[0040] (1.2) Group replay: If the vehicle does not respond to the replay operation in step (1.1), it means that the operation cannot be injected as an attack data frame; if the vehicle has a corresponding action, it means that the CAN bus message controlling the operation is in the data frame group; divide the responsive frame traffic group into two groups in the middle according to the timestamp order, inject it into the vehicle twice and observe whether a corresponding response is generated. If there is still a response, it means that the specific message exists in the group.

[0041] (1.3) Data collection: Repeat the steps of grouping, replaying, and observing the response in step (1.2) multiple times until only one data frame remains in the data frame group, which is the control information corresponding to the operation on the CAN bus; inject this data frame into the vehicle CAN bus at a certain time interval (10 milliseconds, 20 milliseconds, or 50 milliseconds in this embodiment), and collect the CAN bus traffic data at the same time to obtain the attack dataset under this data frame injection.

[0042] By repeating the experiment using the above method on data frame groups acquired under different operations, multiple sets of CAN bus attack datasets under different data frame injection conditions can be obtained, i.e., CAN injection test sets.

[0043] (2) Construction of the anomaly detection neural network model: A neural network model was designed based on the temporal characteristics of the CAN bus to construct an effective unsupervised deep learning anomaly detection model. The neural network model consists of a feature embedding module, a feature extraction module, a feature prediction module, and a reconstruction module. The feature embedding module is responsible for converting the CAN bus data sequence into feature vectors; the feature extraction module is responsible for converting the data into deep feature information; the feature prediction module is responsible for using deep features to predict the corresponding feature vector of the next data item; and the reconstruction module is responsible for re-encoding the feature vectors into the initial sequence format. The unsupervised deep learning anomaly detection model mainly includes a feature embedding module, a temporal decomposition module, a feature enhancement module, and a prediction and reconstruction module.

[0044] (2.1) Based on the CAN bus data sequence obtained in step (1), input the feature embedding module to obtain a one-dimensional feature vector that the model can train, namely the time sequence feature vector.

[0045] Feature embedding module: The feature embedding module consists of two parts: a feature encoder and a position encoder;

[0046] The feature encoder is a single-layer trainable linear fully connected network used to convert shallow, low-dimensional CAN traffic into deep, multi-dimensional time-series features.

[0047] Location coding uses a combination of sine and cosine functions to map the location information of each data frame to a two-dimensional space, giving strong correlation to data that are close in time and weak correlation to data that are far in time.

[0048] The output vector of the feature embedding module can be obtained by directly adding the outputs of the two encoders.

[0049] (2.2) Based on the temporal feature vector obtained in step (2.1), input it into the temporal decomposition module to obtain a two-dimensional feature map.

[0050] Temporal decomposition module: The temporal decomposition module consists of a Fast Fourier Transform (FFT) layer and multiple linear fully connected layers arranged in parallel;

[0051] The FFT layer is used to extract the periodic components of the time series. The result vector of the feature embedding module described in (2.1) is input into the FFT layer. The input sequence is subjected to FFT to obtain multiple period values ​​contained in the time series. The same original sequence is decomposed according to the three time period lengths with the strongest intensity to obtain three groups of vectors with different numbers of each period as the length.

[0052] Linear fully connected layers are used to align the lengths of temporal feature vectors obtained from decomposition at different periods. Each vector group is input into a fully connected layer with different parameters according to different periods, and the outputs feature vectors of the same length. Adding a new dimension to perform parallel operations on the feature vectors can yield several two-dimensional feature maps of the same size.

[0053] (2.3) Based on the two-dimensional feature map obtained in step (2.2), input it into the feature enhancement module to obtain high-dimensional features.

[0054] Feature enhancement module: The feature enhancement module consists of two layers of convolutional neural networks;

[0055] The two convolutional neural networks have the same overall structure; they contain four channels of convolution operations, with kernel sizes of 1x1, 3x3, 5x5, and 7x7 for each channel, and a stride of 1 for each channel. The size of the feature map remains unchanged before and after the convolution calculation. A GeLU activation function is added after the convolutional layer to add a non-linear factor.

[0056] The number of channels remains unchanged after the first layer of convolution. The feature maps of the four convolution results are superimposed to form a high-dimensional feature map with four times the number of input channels.

[0057] The second layer sets the number of input channels to four times the original number of channels and the output to one time the original number of channels. The number of channels in the feature map remains unchanged in the input and output of the feature enhancement module. Inside the feature enhancement module, an inverse residual structure is formed that first increases the dimensionality and then reduces it to achieve the feature enhancement effect. The output of the convolutional layer is activated by GeLU as the result of the enhancement module.

[0058] (2.4) Based on the high-dimensional features obtained in step (2.3), input them into the prediction and reconstruction module to obtain a one-dimensional prediction sequence.

[0059] Predictive Reconstruction Module: The predictive reconstruction module consists of a flattening layer and a fully connected layer;

[0060] The output of the feature enhancement module is a two-dimensional feature map. The flattening layer is used to convert the two-dimensional matrix into a one-dimensional feature vector. The fully connected layer aligns the length of the feature vector with the input vector, that is, converts the length to be equal to the window length, thereby generating the prediction sequence. The prediction sequence output by the prediction reconstruction module is the output data of the model.

[0061] (3) Training the neural network: Input the normal CAN bus data collected in step (1) into the neural network designed in step (2), and use the reconstruction error of the output sequence and the input sequence as the loss function and anomaly score to train the model and realize anomaly detection. Specifically, it includes the following sub-steps:

[0062] (3.1) Data feature extraction: Process the data packets collected in step (1), extract the ID of the CAN data as the first feature, process the timestamp of the CAN data, extract the time interval between adjacent CAN frames as the second feature, extract the time interval between CAN frames with the same ID as the third feature, and merge the three features of each CAN frame into the feature vector of each time point of the time series.

[0063] (3.2) Model training: Based on the CAN frame feature vector sequence calculated in step (3.1), this method windowes it, taking out a window every 100 frames, and taking a new window by sliding 1 frame each time; the model selects the feature vector sequence data of 100 frames in a window as the model input each time.

[0064] The model output is a sequence of predicted vectors. The root mean square error between this output sequence and the next window of input data is used as the loss function of the model. The model is trained using the backpropagation algorithm.

[0065] (3.3) Threshold selection: The training strategy in step (3.2) improves the model’s ability to predict normal data. When abnormal data is input into the model, it will produce an incorrect prediction sequence. Therefore, the root mean square error value of all normal window data in the training set is calculated and obtained by reasoning on the optimal model in step (3.2). The abnormal score threshold of this training set is obtained by using the maximum value theory algorithm.

[0066] (4) Anomaly detection of traffic data: CAN bus data is collected in real time using the method in step (1). The collected data is processed into feature vectors in units of windows as in step (3.1). The feature vectors are then input into the model after training in step (3.2). The root mean square error of the output predicted sequence feature vector and the next window vector of the input vector is calculated to obtain the anomaly score of the window. The obtained anomaly score is compared with the anomaly score threshold obtained in step (3.3). If the score is higher than the threshold, it indicates that the window contains abnormal data. If the score is lower than the threshold, it indicates that the window contains normal data. If multiple consecutive windows contain abnormal data, it indicates that there is an obvious anomaly in the data flow, and the system will issue an alarm.

[0067] Example:

[0068] Data was extracted from a Tesla Model 3, and attacks targeting the vehicle's locks, lights, horn, and brakes were designed to control these components on the CAN bus. The collected attack data yielded the CAN bus attack dataset of this invention. An implementation example of the CAN bus anomaly detection model of this invention was implemented on a device equipped with an Intel Core i7-13700K processor and 32GB of memory. Using all the parameter values ​​listed in the specific embodiments, experimental results show that the method of this invention outperforms existing methods in anomaly detection, accurately identifying abnormal data frames in the CAN bus and effectively distinguishing between normal and abnormal data. Experiments verified the model's detection performance under different attack types, demonstrating that this method can accurately identify abnormal traffic in unknown attack scenarios and exhibits excellent generalization ability. As shown in Table 1 below, compared with traditional detection methods (DCNN, HistCAN, LSTM, Hybrid Model), this method performs superiorly in identifying complex temporal data attacks and can be applied to real-time anomaly detection systems for vehicle CAN buses.

[0069] Table 1. Anomaly detection performance data of this method and existing methods:

[0070] Detection accuracy Denial-of-service attack Malicious injection attack Fuzzy attack DCNN 0.764 0.799 0.821 HistCAN 0.368 0.562 0.306 LSTM 0.642 0.737 0.791 Hybrid Model 0.666 0.677 0.744 This method 0.973 0.959 0.873

[0071] Corresponding to the aforementioned embodiments of the CAN bus traffic anomaly detection method based on unsupervised deep learning, the present invention also provides embodiments of a CAN bus traffic anomaly detection device based on unsupervised deep learning.

[0072] See Figure 2 The CAN bus traffic anomaly detection device based on unsupervised deep learning provided in this embodiment of the invention includes one or more processors for implementing the CAN bus traffic anomaly detection method based on unsupervised deep learning in the above embodiment.

[0073] The embodiments of the CAN bus traffic anomaly detection device based on unsupervised deep learning of this invention can be applied to any device with data processing capabilities, such as a computer. The device embodiments can be implemented in software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of any data processing device loading the corresponding computer program instructions from non-volatile memory into memory for execution. From a hardware perspective, such as... Figure 2The diagram shown is a hardware structure diagram of any data processing-capable device, including the CAN bus traffic anomaly detection device based on unsupervised deep learning according to the present invention. Except for... Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0074] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0075] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the present invention according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0076] Corresponding to the aforementioned embodiments of the CAN bus traffic anomaly detection method based on unsupervised deep learning, this application also provides an electronic device, including: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the CAN bus traffic anomaly detection method based on unsupervised deep learning as described above. Figure 3 The diagram shown is a hardware structure diagram of any device with data processing capabilities for the CAN bus traffic anomaly detection method based on unsupervised deep learning provided in this application embodiment, except... Figure 3 In addition to the processor, memory, DMA controller, disk, and non-volatile memory shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0077] Corresponding to the aforementioned embodiments of the CAN bus traffic anomaly detection method based on unsupervised deep learning, this embodiment of the invention also provides a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements the CAN bus traffic anomaly detection method based on unsupervised deep learning in the above embodiments.

[0078] The computer-readable storage medium can be an internal storage unit of any data processing device described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be any data processing device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units of any data processing device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the data processing device, and can also be used to temporarily store data that has been output or will be output.

[0079] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0080] The above embodiments are only used to illustrate the design concept and features of the present invention, and their purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, all equivalent changes or modifications made based on the principles and design ideas disclosed in the present invention are within the protection scope of the present invention.

Claims

1. A method for detecting abnormal CAN bus traffic based on unsupervised deep learning, characterized in that, Includes the following steps: (1) Generate CAN bus attack test set: Collect vehicle CAN bus traffic data, perform data preprocessing, and use it as a training set; Design a message injection attack method for the CAN bus, perform the injection attack in a real vehicle, and collect data as a CAN injection test set. (1.1) Collect vehicle CAN bus data packets under normal conditions; obtain several CAN bus binary data frame groups under different vehicle operating conditions, i.e. training set; replay one of the groups on the vehicle CAN bus in the original order and observe whether the vehicle generates a corresponding response under no other operation. (1.2) If the vehicle does not respond to the replay operation in step (1.1), it means that the operation cannot be injected as an attack data frame; if there is a response, the data frame group is divided into two groups in the middle in sequence, and injected into the vehicle to observe whether there is a response. The group that responds is selected as the data frame group for the next injection. (1.3) Repeat the steps of grouping, replaying, and observing the response in step (1.2) until the remaining data frame group contains only one single data frame, which is the data frame that can be injected with the attack; inject this data frame into the vehicle CAN bus at a certain time interval, and collect the CAN bus traffic data at the same time to obtain the attack dataset under this data frame injection. (1.4) Repeat the above steps for the data frame groups collected by different operations in step (1.1) to obtain multiple sets of CAN bus attack datasets under different data frame injection, i.e. test sets; (2) Construct an unsupervised deep learning anomaly detection model, including a feature embedding module, a temporal decomposition module, a feature enhancement module, and a prediction reconstruction module; wherein, the feature embedding module is used to convert the CAN bus data sequence into a one-dimensional temporal feature vector that the model can train; the temporal decomposition module is used to decompose the temporal feature vector into multiple periodic components, and generate a two-dimensional feature map through a fast Fourier transform layer and a linear fully connected layer; the feature enhancement module is used to extract high-dimensional features from the two-dimensional feature map, and realize the feature first increasing the dimensionality and then decreasing the dimensionality through a multi-layer convolutional neural network; the prediction reconstruction module is used to convert the high-dimensional features into a one-dimensional prediction sequence, and generate a prediction result with the same length as the input sequence through a flattening layer and a fully connected layer; (3) Train the unsupervised deep learning anomaly detection model: Input the CAN bus data training set collected in step (1) into the unsupervised deep learning anomaly detection model designed in step (2), and use the reconstruction error of the output sequence and the input sequence as the loss function and anomaly score for model training; (4) Detect CAN bus traffic data: Input the CAN bus data test set collected in step (1) into the model trained in step (3), output the abnormal score, and judge whether the data is abnormal by comparing the abnormal score and the threshold. If there is abnormal data, trigger an alarm.

2. The CAN bus traffic anomaly detection method based on unsupervised deep learning according to claim 1, characterized in that, Step (2) includes the following sub-steps: (2.1) Based on the CAN bus data obtained in step (1), input the feature embedding module to obtain a one-dimensional feature vector that the model can train; The feature embedding module consists of a feature encoder and a position encoder; the feature encoder is a single-layer linear fully connected network used to convert shallow, low-dimensional CAN traffic into deep, multi-dimensional time-series features. Position encoding uses a combination of sine and cosine functions to map the position information of each data frame to a two-dimensional space, assigning strong correlation to data that are close in time and weak correlation to data that are far in time; the outputs of the two encoders are directly added together to obtain the output vector of the feature embedding module. (2.2) Based on the temporal feature vector obtained in step (2.1), input it into the temporal decomposition module to obtain a two-dimensional feature map; the temporal decomposition module consists of a fast Fourier transform layer and multiple linear fully connected layers in parallel. Input the result vector of the feature embedding module in step (2.1) into the fast Fourier transform layer to obtain multiple periods contained in the sequence. Decompose the original sequence into vector groups of different lengths and numbers according to the k time periods with the strongest intensity. Each vector group is input into the corresponding fully connected layer according to the different periods. The output vector is added with a new dimension and parallel operation is performed to obtain a two-dimensional feature map; (2.3) Based on the two-dimensional feature map obtained in step (2.2), input it into the feature enhancement module to obtain high-dimensional features; the feature enhancement module consists of two layers of convolutional neural networks. The first layer contains a 4-channel convolutional layer. The kernel size of each channel is 1x1, 3x3, 5x5, and 7x7, respectively. The convolution stride is 1. The number of channels after convolution becomes one-quarter of the original feature map. The boundary padding of the convolution ensures that the size of the two-dimensional feature map remains unchanged. After each channel is convolved, it is superimposed according to the channel dimension of the output feature map to form a high-dimensional feature map with four times the number of input channels; the result of the first layer convolution is processed by GeLU activation and then input into the second layer; The second layer has the same convolutional structure as the first layer, with four times the original number of input channels and one times the original number of output channels, forming an inverse residual structure to complete feature enhancement; the output of the convolutional layer is activated by GeLU as the result of the enhancement module. (2.4) Based on the high-dimensional features obtained in step (2.3), input them into the prediction reconstruction module to obtain the prediction sequence; the prediction reconstruction module consists of a flattening layer and a fully connected layer. The flattening layer is used to convert the high-dimensional feature map into a one-dimensional feature vector, and the fully connected layer aligns the length of the feature vector with the input vector to generate the prediction sequence; the prediction sequence output by the prediction reconstruction module is the output data of the model.

3. The CAN bus traffic anomaly detection method based on unsupervised deep learning according to claim 2, characterized in that, Step (3) includes the following sub-steps: (3.1) Process the data packets collected in step (1), extract the ID of the CAN data as the first feature, process the timestamp of the CAN data, extract the time interval between adjacent CAN frames as the second feature, extract the time interval between CAN frames with the same ID as the third feature, and merge the three features of each CAN frame into the feature vector of each time point of the time series. (3.2) Window the feature vectors obtained in step (3.1), draw a window every 100 frames, and slide a new window every time. Input the feature vector sequence of 100 frames in a window into the model designed in step (2) to obtain the output sequence. Calculate the root mean square error between the output prediction vector sequence and the next window of the input sequence, and use it as the loss function for model training. Use the backpropagation algorithm to train the model. (3.3) Calculate the root mean square error value of each window of the training set obtained by inference on the optimal model in step (3.2), and calculate the average to obtain the anomaly score threshold of this training set.

4. The CAN bus traffic anomaly detection method based on unsupervised deep learning according to claim 3, characterized in that, The specific process of step (4) is as follows: The CAN bus data is collected in real time using the method in step (1). The collected data is processed into feature vectors in units of windows as in step (3.1). The feature vectors are then input into the model after training in step (3.2). The root mean square error of the output predicted sequence feature vector and the next window vector of the input vector is calculated to obtain the abnormal score of the window. The obtained abnormal score is compared with the abnormal score threshold obtained in step (3.3). If the score is higher than the threshold, it indicates that the window contains abnormal data. If the score is lower than the threshold, it indicates that the window contains normal data. If multiple consecutive windows contain abnormal data, it indicates that there is a significant abnormality in the data flow, and the system will issue an alarm.

5. A CAN bus traffic anomaly detection device based on unsupervised deep learning, characterized in that, It includes one or more processors for implementing the CAN bus traffic anomaly detection method based on unsupervised deep learning as described in any one of claims 1-4.

6. An electronic device comprising a memory and a processor, characterized in that, The memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the CAN bus traffic anomaly detection method based on unsupervised deep learning as described in any one of claims 1-4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the CAN bus traffic anomaly detection method based on unsupervised deep learning as described in any one of claims 1-4.

Images