Abnormal flow detection method for CAN bus

Abstract

The invention discloses an abnormal traffic detection method for a CAN bus, and the method comprises the steps: carrying out the multi-dimensional original feature extraction of normal CAN bus data sets of different vehicle types through a cloud server, and marking the extracted multi-dimensional original features; the cloud server inputs the labeled multi-dimensional original feature data into an anomaly detection model for training through a domain adversarial adaptive network; the cloud server issues the trained anomaly detection model to the road side unit through edge calculation; the vehicle extracts multi-dimensional original features of unknown CAN bus data in real time and uploads the multi-dimensional original features to the road side unit for online anomaly detection; according to the method, the defects of existing CAN bus anomaly detection in the aspects of identifying multiple attack behaviors, cross-vehicle-type universality and vehicle-mounted computing resource pressure are overcome, and the method has the advantages that the detection accuracy and comprehensiveness are improved, the model generalization ability and adaptability are enhanced, the resource utilization rate is optimized, and the system performance is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle information security, and particularly relates to an abnormal traffic detection method for a Controller Area Network (CAN) bus. Background Art

[0002] With the continuous development of network communication technology, the Internet of Things (IoT) and Internet of Vehicles (IoV) technologies have developed rapidly. Modern vehicles have gradually evolved into network-controlled vehicles, including autonomous vehicles (AVs) and connected vehicles (CVs). A typical IoV system is divided into an in-vehicle network (IVN) and an external network. The Controller Area Network (CAN) bus is an important in-vehicle network communication protocol. Due to the high reliability, anti-interference ability, and low cost of the CAN bus, it is widely used in modern vehicles for information exchange between various Electronic Control Units (ECUs). However, since the CAN bus uses broadcast communication and has no security mechanism itself, the CAN protocol is vulnerable to message injection attacks. Moreover, with the continuous development of in-vehicle Bluetooth, Wi-Fi, and mobile cellular network technologies, the network connectivity and accessibility of vehicles have been significantly enhanced. This also makes the CAN bus more vulnerable to internal and external network attacks. Attackers can attack the CAN bus through physical means such as USB interfaces and the second-generation On-Board Diagnostics (OBD-II) interfaces, or by using wireless interfaces such as Bluetooth and Wi-Fi. Such attacks may not only lead to the leakage of vehicle owners' private data, but more seriously, pose a major threat to the personal safety of vehicle owners.

[0003] At present, the security defense strategies for CAN bus are mainly divided into two categories. One of them is the active defense strategy based on encryption authentication, which realizes active protection by encrypting the plaintext messages transmitted on the CAN bus and authenticating the sender. However, due to the limited length of CAN message frames, the encryption and authentication operations will significantly increase the load of the CAN bus, further reducing the available bandwidth of normal data frames and affecting system performance. The other category is the anomaly detection technology for CAN bus. Anomaly detection is a protection method that does not require modifying the CAN bus protocol. Currently, the anomaly detection schemes for CAN bus mainly perform anomaly detection through models trained by machine learning. However, the current schemes still have the following three main problems: First, relying only on single-dimensional features, such as time series, data frame content, or physical layer characteristics, results in limited effectiveness in identifying various complex attack behaviors. Second, due to the differences in the structures and meanings of CAN data frames among different vehicle manufacturers, the anomaly detection models have low generality among different vehicle models. Third, the detection models are usually directly deployed on vehicles, and this deployment mode increases the pressure on in-vehicle computing resources.

[0004] The invention patent application with the publication number CN116827641 A proposes a method and system for detecting and tracing abnormal traffic on an in-vehicle CAN bus. This method uses a graph convolutional network (GCN) combined with a node feature matrix, a feature adjacency matrix, and a mapping table of CAN ID and ECU to solve the technical problem that the existing in-vehicle network anomaly detection cannot trace the abnormal ECU, and achieves the effect of accurately locating the abnormal ECU. However, this method only constructs features based on CAN ID and fails to fully utilize multi-dimensional information, limiting the detection ability of complex attack behaviors; at the same time, it does not consider the data distribution differences among different vehicle models, resulting in low cross-vehicle generality, and does not solve the model deployment problem. Summary of the Invention

[0005] In order to overcome the defects of the above-mentioned existing technologies, the purpose of the present invention is to provide an abnormal traffic detection method for CAN bus. This method extracts multi-dimensional original features from the normal CAN bus data sets of different vehicle models, uses a domain adversarial adaptive network to input the multi-dimensional original feature data into an anomaly detection model for training, and deploys the trained anomaly detection model to a roadside unit for anomaly detection through edge computing, solving the deficiencies of the existing CAN bus anomaly detection in identifying various attack behaviors, cross-vehicle generality, and in-vehicle computing resource pressure, and having the characteristics of improving detection accuracy and comprehensiveness, enhancing the generalization ability and adaptability of the model, optimizing resource utilization, and improving system performance.

[0006] To achieve the above purpose, the technical solution adopted by the present invention is as follows:

[0007] An abnormal traffic detection method for CAN bus, comprising the following steps:

[0008] Step 1: The cloud server performs multi-dimensional original feature extraction on the normal CAN bus data sets of different vehicle models, and labels the extracted multi-dimensional original features;

[0009] Step 2: The cloud server inputs the labeled multi-dimensional original feature data in Step 1 into the anomaly detection model through a domain adversarial adaptive network for training;

[0010] Step 3: The cloud server distributes the anomaly detection model trained in Step 2 to the roadside unit through edge computing;

[0011] Step 4: The vehicle extracts the multi-dimensional original features of the unknown CAN bus data in real time and uploads them to the roadside unit in Step 3 for online anomaly detection.

[0012] Further, Step 1 specifically includes:

[0013] Step 1.1: The cloud server collects and integrates the normal CAN bus data sets of different vehicle models;

[0014] Step 1.2: The cloud server sorts the data frames in the normal CAN data set in Step 1.1 according to the time series and extracts the CAN data frames within the sliding window;

[0015] Step 1.3: Within the sliding window in Step 1.2, the Hamming distance, Hamming weight, and cosine similarity are used to extract features from the time dimension, arbitration field, and data field of the CAN data frame respectively, to obtain the original multi-dimensional feature data set of the sliding window.

[0016] Step 1.4: Label the original multi-dimensional feature data set in Step 1.3 with the corresponding vehicle model.

[0017] Further, Step 1.2 specifically includes:

[0018] Determine that the sliding window size is n, and within the sliding window, take CAN 1 as the first CAN data frame, and CAN n as the end frame, then the CAN data frame sequence is:

[0019] CAN series ={CAN 1 ,CAN 2 ...,CAN n}

[0020] Extract the timestamp, arbitration field, and data field in each CAN data frame within the window, and convert the hexadecimal in the arbitration field and data field to binary.

[0021] Further, step 1.3 specifically includes:

[0022] Step 1.3.1: Feature extraction in the time dimension

[0023] Define t i as the timestamp of each CAN data frame within the window, and calculate the timestamp t i of each CAN data frame within the window and the timestamp t i-1 of the previous CAN data frame. The time difference between adjacent CAN data frames is:

[0024] Δt i = t i - t i-1

[0025] Step 1.3.2: Feature extraction of the arbitration field

[0026] Define the arbitration field of each CAN data frame within the window as id, which is composed of 11-bit binary:

[0027] id = {d 1 , d 2 ,..., d 11}

[0028] d i ∈ {0, 1}

[0029] Calculate the Hamming weight of the arbitration field of the CAN data frame as:

[0030]

[0031] Define the arbitration field of the current CAN data frame as id i , and the arbitration field of the data frame adjacent to the current CAN data frame as id i-1 . Then the Hamming distance between the arbitration fields of adjacent CAN data frames is:

[0032]

[0033] where id i [j] ∈ {0, 1} represents the j-th value of the 11-bit binary sequence of the arbitration field id i ; represents the bitwise exclusive OR operation;

[0034] Calculate the frequency of occurrence of the arbitration field of each CAN data frame within the window:

[0035]

[0036] where Ni Indicates the number of arbitration fields of data frames in the window that are the same as the arbitration field of the current CAN data frame; n represents the window size;

[0037] Step 1.3.3: Feature extraction of the data field

[0038] The data field consists of several bytes, and its quantity is determined by the DLC; define the binary form of the data field of the CAN data frame as follows:

[0039] data = {d 1 , d 2 ,..., d 8·DLC}

[0040] d i ∈ {0, 1}

[0041] Calculate the Hamming weight of the data field of the CAN data frame as:

[0042]

[0043] Define the data field of the current CAN data frame as data i , and the data field of the previous CAN data frame in the window as data i-1 , then the Hamming distance between the data fields of adjacent CAN data frames is:

[0044]

[0045] where data i [j] ∈ {0, 1} represents the value of the j-th bit in the 64-bit binary sequence of the data field data i ; if the length of the data field is less than 64 bits, missing bits need to be filled with 0 before calculation;

[0046] Find the data frame in the sequence that has the same arbitration field as the current CAN data frame and is the closest. If such a data frame is found, calculate the Hamming distance D s between the data fields of the current data frame and this data frame, that is, the Hamming distance of the data field of the closest CAN data frame with the same arbitration field is:

[0047]

[0048] where data i represents the data field of the current CAN data frame; data s represents the data field of the data frame that is the closest to the current CAN data frame and has the same data field; if there is no CAN data frame with the same arbitration field, to avoid missing values, the corresponding distance feature will be set to 0;

[0049] Calculate the information entropy of the data field of the CAN data frame:

[0050]

[0051] where pi represents the probability of the occurrence of 0 or 1 in the data frame data i in;

[0052] Step 1.3.4: Based on the time difference Δt between adjacent CAN data frames in Step 1.3.1 i , the Hamming weight hw of the arbitration field of the CAN data frame in Step 1.3.2 id , the Hamming distance D between the arbitration fields of adjacent CAN data frames idi , the frequency of occurrence of the arbitration field of the CAN data frame the Hamming weight hw of the data field of the CAN data frame in Step 1.3.3 data , the Hamming distance D between the data fields of adjacent CAN data frames i , the Hamming distance D between the data fields of the CAN data frames with the same arbitration field recently s , the information entropy Entropy of the data field of the CAN data frame constructs a multi-dimensional original feature data set of the CAN bus.

[0053] Furthermore, the anomaly detection model in Step 2 specifically includes:

[0054] Feature calculator: Calculate the original feature data of the vehicle CAN bus data set and provide input for the feature extractor;

[0055] Feature extractor: Map the original feature data to the latent feature space and generate latent feature representations;

[0056] Decoder: Reconstruct the latent feature representations output by the feature extractor into original feature data;

[0057] Domain discriminator: Symmetric with the feature extractor, used to reconstruct the latent feature representations output by the feature extractor into original feature data;

[0058] Training layer: Generate original feature data from the normal data of the CAN bus of different vehicle models through the feature calculator, and then jointly optimize the feature extractor, decoder and domain discriminator to achieve the following goals:

[0059] Minimize the reconstruction loss of the decoder and improve the reconstruction ability of the feature extractor;

[0060] Maximize the classification loss of the domain discriminator and enhance the cross-domain ability of the feature extractor, so as to extract domain-invariant feature representations;

[0061] Generate a detection threshold for the reconstruction error based on the reconstruction loss distribution of normal data;

[0062] Anomaly detection layer: After the unknown CAN bus data of the vehicle is generated into raw feature data by the feature calculator, based on the feature extractor and decoder trained by the training layer, calculate the reconstruction error for the raw feature data; if the error exceeds the generated detection threshold, it is detected as an abnormal state;

[0063] Output layer: Output the final anomaly detection result.

[0064] Furthermore, the specific steps of step 2 are as follows:

[0065] Step 2.1: Input the multi-dimensional raw feature data labeled in step 1 into the feature extractor;

[0066] Step 2.2: The feature extractor transfers the multi-dimensional raw feature data labeled in step 2.1 to a fully connected layer through the hidden state, and the output of the fully connected layer is further mapped to the decoder;

[0067] Step 2.3: The decoder reconstructs the output of the fully connected layer in step 2.2 into multi-dimensional raw feature data, and generates a reconstruction loss for the multi-dimensional raw feature data from the source domain and the target domain;

[0068] Step 2.4: The domain discriminator discriminates the vehicle model based on the output of the fully connected layer in step 2.2, and optimizes the domain discriminator classification loss in the reverse direction;

[0069] Step 2.5: While minimizing the reconstruction loss of the decoder in step 2.3, maximize the domain discriminator classification loss in step 2.4, so that the feature extractor can learn the domain-invariant features of different vehicle models to complete the training of the anomaly detection model.

[0070] Furthermore, the reconstruction loss in step 2.3 specifically includes:

[0071]

[0072] Among them, L c represents the reconstruction loss; N represents the number of samples; x i represents the i-th vehicle raw feature input data; represents the i-th reconstructed data generated by the decoder.

[0073] Furthermore, the domain discriminator classification loss in step 2.4 specifically includes:

[0074]

[0075] Among them, L d represents the loss function of the domain discriminator; yi represents the true label of the sample; c i represents the discrimination result of the domain discriminator on the input data; N represents the number of samples.

[0076] Further, step 3 specifically includes:

[0077] Step 3.1: The cloud server packages the trained anomaly detection model into a format suitable for roadside unit deployment, preparing for subsequent distribution and deployment;

[0078] Step 3.2: The cloud server selects a suitable roadside unit to distribute the anomaly detection model according to the computing power, network status and task requirements of the edge node.

[0079] Further, step 3.2 specifically includes:

[0080] Step 3.2.1: Evaluation of the computing power and network status of the edge node

[0081] The cloud server collects and records the CPU performance, memory resources, GPU resources, bandwidth, latency, packet loss rate of the roadside unit in real time, as well as the task quantity and resource occupancy rate of the node;

[0082] Step 3.2.2: Task requirement analysis and node matching

[0083] According to the complexity of the anomaly detection model to be distributed, the inference time limit and the network latency tolerance, the cloud server establishes an evaluation model, conducts the adaptability matching between the roadside unit and the task requirements, calculates the adaptability score of each node, and determines the priority ranking;

[0084] Step 3.2.3: Selection of the optimal node and model distribution

[0085] The cloud server selects the roadside unit with the highest ranking as the model deployment target according to the adaptability ranking result, and pushes the anomaly detection model to the corresponding roadside unit.

[0086] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0087] 1. The present invention extracts multi-dimensional original features from the normal CAN bus data sets of different vehicle models through the cloud server, solves the problem that the existing anomaly detection solutions rely only on single-dimensional features, resulting in limited effects in identifying various complex attack behaviors, and obtains the ability to detect various types of attacks, with the characteristics of improving detection accuracy and comprehensiveness.

[0088] 2. The present invention feeds multi-dimensional raw feature data into an anomaly detection model through a domain adversarial adaptive network for training, solves the problem of low generality of the anomaly detection model among different vehicle models, obtains the anomaly detection ability across vehicle models, and has the characteristics of enhancing the generalization ability and adaptability of the model.

[0089] 3. The present invention deploys the trained anomaly detection model to the roadside unit through edge computing for anomaly detection, solves the problem of increasing the pressure on in-vehicle computing resources when directly deploying the detection model on the vehicle, obtains the effect of significantly reducing the burden on in-vehicle computing resources, and has the characteristics of optimizing resource utilization and improving system performance.

[0090] In summary, the present invention extracts multi-dimensional raw features of normal CAN bus data sets of different vehicle models, inputs the multi-dimensional raw feature data into the anomaly detection model for training by using a domain adversarial adaptive network, and deploys the trained anomaly detection model to the roadside unit through edge computing for anomaly detection, solves the deficiencies of existing CAN bus anomaly detection in identifying various attack behaviors, cross-vehicle generality, and in-vehicle computing resource pressure, and has the characteristics of improving detection accuracy and comprehensiveness, enhancing the generalization ability and adaptability of the model, optimizing resource utilization rate, and improving system performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0091] Figure 1 It is a flowchart of an anomaly traffic detection method for CAN bus.

[0092] Figure 2 It is a sequence of CAN data frames captured by a sliding window.

[0093] Figure 3 It is a domain adversarial adaptive neural network.

[0094] Figure 4 It is a basic structure diagram of an anomaly detection model.

[0095] Figure 5 It is a basic architecture diagram of an autoencoder.

[0096] Figure 6 It is a schematic diagram of anomaly detection.

[0097] Figure 7 It is a flowchart of offline training and online detection of an anomaly detection model.

[0098] Figure 8 It is an architecture diagram of cloud-edge-vehicle collaborative anomaly detection.

[0099] Figure 9 It is the influence of window size on the accuracy of an anomaly detection model.

[0100] Figure 10The characteristic distributions of the normal data for the Soul model and the Sonata model.

[0101] Figure 11 The characteristic distributions of the data for the Soul model and the Sonata model after training.

[0102] Figure 12 The cross-model detection comparison effect curves of three different detection schemes: the scheme based on the present invention, the autoencoder (AE) scheme, and the CANet scheme. Detailed implementation manners

[0103] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments:

[0104] Aiming at the problems of the existing CAN bus anomaly detection scheme relying on a single feature, poor model generality, and increased computational burden in in-vehicle deployment, the present invention proposes an anomaly traffic detection method for the CAN bus based on domain adversarial adaptive cloud-edge-vehicle collaboration and edge computing, as Figure 1 shown, including the following steps:

[0105] Step 1: The cloud server extracts multi-dimensional original features from the normal CAN bus data sets of different models and labels the extracted multi-dimensional original features;

[0106] In this embodiment, the normal CAN bus data of various models are pre-stored in the cloud server to ensure that the subsequent training process is not affected by abnormal attack data and improve the security of the entire system; at the same time, by extracting useful feature information from the CAN bus data set, it is convenient to more effectively perform subsequent anomaly detection model training.

[0107] Further, the specific steps of Step 1 include:

[0108] Step 1.1: The cloud server collects and integrates the normal CAN bus data sets of different models;

[0109] Step 1.2: The cloud server sorts the data frames in the normal CAN data set in Step 1.1 according to the time series and extracts the CAN data frames within the sliding window;

[0110] Further, the specific steps of Step 1.2 include:

[0111] Determine that the size of the sliding window is n. In the sliding window, take CAN 1 as the first CAN data frame, and CAN n as the end frame. Then the CAN data frame sequence is:

[0112] CAN series ={CAN 1 ,CAN2 ..., CAN n}

[0113] As Figure 2 shown, extract the timestamp, arbitration field, and data field in each CAN data frame within the extraction window, and convert the hexadecimal in the arbitration field and data field into binary;

[0114] Step 1.3: Within the sliding window in Step 1.2, extract features from the time dimension, arbitration field, and data field of the CAN data frame using Hamming distance, Hamming weight, and cosine similarity respectively to obtain the original multi-dimensional feature dataset of the sliding window;

[0115] Further, the specific steps of Step 1.3 include:

[0116] Step 1.3.1: Feature extraction in the time dimension

[0117] Define t i as the timestamp of each CAN data frame within the window, and calculate the interval between the timestamp t i of each CAN data frame within the window and the timestamp t i-1 of the previous CAN data frame, that is, the time difference between adjacent CAN data frames is:

[0118] Δt i = t i - t i-1

[0119] Take the time interval as the feature in the time dimension. After the calculation, set the time interval of the starting frame within the window to 0; then the final time interval feature sequence within one window is:

[0120] (0, Δt 1 , Δt 2 ,..., Δt n )

[0121] Step 1.3.2: Feature extraction in the arbitration field

[0122] Define the arbitration field of each CAN data frame within the window as id, which is composed of 11-bit binary:

[0123] id = {d 1 , d 2 ,..., d 11}

[0124] d i ∈ {0, 1}

[0125] Calculate the Hamming weight of the arbitration field of the CAN data frame as:

[0126]

[0127] In this embodiment, the Hamming Weight is an index that measures the number of non-zero elements (usually 1) in a string, and it is also the number of bits with a value of 1 in the string; the concept of Hamming Weight is very important in multiple fields, including information theory, coding theory, and other fields related to binary data processing; assuming there is a binary string C with a length of n, the Hamming weight W(C) of this string can be calculated by the following formula:

[0128]

[0129] where c i is the value of the string C at position i; only when c i = 1, this term will be included in the sum;

[0130] The application of Hamming weight in feature extraction is mainly based on its characteristic of being able to quantify the density and difference of information; by measuring the number of non-zero elements in a data vector, the Hamming weight can be used as a simple and effective way to help distinguish and identify different patterns or categories in a dataset; in an anomaly detection task, a feature vector that is very different from most data points may have a significantly different Hamming weight; by analyzing the distribution of Hamming weights, those abnormal data points or data points that do not conform to the overall distribution pattern can be identified;

[0131] Define the arbitration field of the current data frame as id i , and the arbitration field of the data frame adjacent to the current data frame is id i-1 , then the Hamming distance of the arbitration fields of adjacent data frames is:

[0132]

[0133] where id i [j] ∈ {0, 1} represents the j-th value of the 11-bit binary sequence of the arbitration field id i ; represents the bitwise exclusive OR operation;

[0134] In this embodiment, the Hamming Distance is an index that measures the difference between two strings of equal length, and it is used to describe the number of different characters at the corresponding positions of two strings of the same length; assuming two strings of equal length A and B with a length of n, the Hamming distance D(A, B) can be calculated by the following formula:

[0135]

[0136] where a iRepresents the eigenvalue of data point A at position i; b i Represents the eigenvalue of data point B at position i; when a i Is not equal to b i It indicates that there is a difference between the two data points at this position. Therefore, the value of (a i ≠b i ) is counted as 1, otherwise 0;

[0137] Hamming distance is mainly used as a tool for feature extraction in the field of anomaly detection; in anomaly detection, using Hamming distance for feature extraction can help identify irregular and abnormal patterns in the dataset;

[0138] Calculate the frequency of occurrence of the arbitration field in each CAN data frame within the window:

[0139]

[0140] Among them, N i Represents the number of arbitration fields of data frames within the window that are the same as the arbitration field of the current CAN data frame; n represents the window size;

[0141] Step 1.3.3: Feature extraction of data fields

[0142] The data field consists of several bytes, and its quantity is determined by DLC; define the binary form of the data field of the CAN data frame as follows:

[0143] data = {d 1 , d 2 ,..., d 8·DLC}

[0144] d i ∈ {0, 1}

[0145] Calculate the Hamming weight of the data field of the CAN data frame as:

[0146] Define the data field of the current CAN data frame as data i , and the data field of the previous CAN data frame within the window as data i-1 , then the Hamming distance between the data fields of adjacent data frames is:

[0147]

[0148] Among them, data i [j] ∈ {0, 1} represents the value of the j-th bit in the 64-bit binary sequence of the data field data i ; if the length of the data field is less than 64 bits, missing bits need to be filled with 0 before calculation;

[0149] Find the data frame in the sequence that has the same arbitration field as the current CAN data frame and is the closest. If such a data frame is found, calculate the Hamming distance D between the data fields of the current data frame and this data frame s , that is, the Hamming distance of the data field of the CAN data frame with the closest same arbitration field is:

[0150]

[0151] where data i represents the data field of the current CAN data frame; data s represents the data field of the data frame that is the closest to the current CAN data frame and has the same data field; if there is no CAN data frame with the same arbitration field, to avoid missing values, the corresponding distance feature will be set to 0;

[0152] Calculate the information entropy of the data field of the CAN data frame:

[0153]

[0154] where p i represents the probability of the occurrence of 0 or 1 in the data frame data i ;

[0155] The information entropy (Entropy) in this embodiment is one of the metrics for measuring the randomness or uncertainty of information. The higher the entropy, the greater the uncertainty contained in the information; the lower the entropy, the smaller the uncertainty of the information.

[0156] The mathematical definition of information entropy is: Assume that an information source can emit a series of possible messages, and the probability of the occurrence of the i-th message is p(i). Then the entropy H of this information source can be expressed by the following formula:

[0157]

[0158] where the unit of entropy is bits; this formula represents the negative logarithm weighted average of the occurrence probability of an event, providing a measure of the uncertainty of a random variable; when the occurrence probabilities of all events in a system are equal, the information entropy of this system reaches the maximum value, reflecting the highest uncertainty;

[0159] The application of information entropy in anomaly detection mainly relies on its ability to measure information uncertainty, providing an effective means for identifying anomalies or unusual patterns in data; during the anomaly detection process of time series data, by analyzing the entropy change of data within a time window, mutations in data behavior can be detected;

[0160] Step 1.3.4: Based on the time difference Δt between adjacent CAN data frames in Step 1.3.1 i and the Hamming weight hw of the arbitration field of the CAN data frame in Step 1.3.2 id and the Hamming distance between the arbitration fields of adjacent CAN data frames the frequency of occurrence of the arbitration field of the CAN data frame the Hamming weight hw of the data field of the CAN data frame in Step 1.3.3 data and the Hamming distance D between the data fields of adjacent CAN data frames i and the Hamming distance D between the data fields of the CAN data frames with the same arbitration field that are closest s and the information entropy Entropy of the data field of the CAN data frame to construct a multi-dimensional original feature dataset of the CAN bus;

[0161] As shown in Table 1, all the features extracted based on the characteristics of the CAN data frame window sequence in this embodiment construct a feature vector sequence composed of 8 dimensions. This feature sequence is input into the anomaly detection model in units of windows for model training and the execution of anomaly detection tasks;

[0162] Table 1 Feature Vector Sequence Table

[0163]

[0164] Step 1.4: Label the original multi-dimensional feature dataset in Step 1.3 according to the corresponding vehicle models.

[0165] Step 2: The cloud server inputs the multi-dimensional original feature data labeled in Step 1 into the anomaly detection model through the domain adversarial adaptive network for training; in this embodiment, the multi-dimensional original feature data is input into the anomaly detection model through the domain adversarial adaptive network for training, which solves the problem of low generality of the anomaly detection model among different vehicle models, obtains cross-vehicle anomaly detection capabilities, and has the characteristics of enhancing the generalization ability and adaptability of the model;

[0166] In this embodiment, the domain adversarial adaptive network is an instantiation of the domain adversarial adaptive algorithm under a specific network structure, and the two are essentially the same; the domain adversarial adaptive algorithm (Domain-Adversarial Training of Neural Networks, DANN) is a technique used in the fields of deep learning and transfer learning, aiming to solve the domain adaptation problem; the goal is to train a model that can perform well in the transfer from the source domain (the dataset used during training) to the target domain (the dataset used in actual applications), even if the data in the target domain is not seen during the training phase; the specific working principle of this algorithm is given below:

[0167] Given an input space \(X = \{x 1 , x 2 , \ldots, x n \}\), a binary label set \(Y=\{0, 1\}\), and a binary classifier \(\eta: X\rightarrow Y\); given a source domain and a target domain The feature extraction neural network \(G f can be defined as:

[0168] G f (x; W, b)=\text{sigmoid}(Wx + b)

[0169] where \((W, b)\) represents the network weights and biases; \(x\in D s ;\)

[0170] The label classifier network \(G C can be expressed as:

[0171] G C (G f (x); V, c)=\text{sigmoid}(VG f (x)+c)

[0172] where \((V, c)\) represents the network parameters;

[0173] The domain discriminator network \(G D can be formulated as:

[0174] G D (G f (x); u, z)=\text{sigmoid}(u T G f (x)+z)

[0175] where \((u, z)\) represents the network parameters;

[0176] More specifically, for a given sample-label pair \((x, y)\), \(x\in X\), \(y\in Y\), the loss \(L D of the domain discriminator is defined as follows:

[0177]

[0178] And

[0179]

[0180] where \(\gamma i represents the domain label of the sample \(x i ; if \(x i is from the source domain, then \(\gamma i = 1\), otherwise \(\gamma i = 0\);

[0181] Among them, the label classifier loss L y is defined as:

[0182]

[0183] The optimization function of the domain adversarial neural network can be written as:

[0184]

[0185] Among them, n S represents the number of samples from the source domain; n T represents the number of samples from the target domain;

[0186] As Figure 3 shown, when training with the domain adversarial adaptive algorithm, the two simultaneous processes of label classifier training and domain discriminator training play a key role;

[0187] As Figure 4 shown, the training of the anomaly detection model in this embodiment uses the domain adversarial neural network (DANN) as the basic network framework, where the encoder in the autoencoder network is used as the feature extractor, and the decoder reconstructs the extracted features, and then a fully connected layer neural network is used as the domain discriminator in the adversarial training;

[0188] Furthermore, the anomaly detection model in step 2 specifically includes:

[0189] Feature calculator: Calculate the original feature data of the vehicle CAN bus dataset and provide input for the feature extractor;

[0190] Feature extractor: Map the original feature data to the latent feature space and generate the latent feature representation;

[0191] Decoder: Reconstruct the latent feature representation output by the feature extractor into the original feature data;

[0192] Domain discriminator: Symmetric to the feature extractor, used to reconstruct the latent feature representation output by the feature extractor into the original feature data;

[0193] Training layer: Generate the original feature data from the CAN bus normal data of different vehicle models through the feature calculator, and then jointly optimize with the feature extractor, decoder and domain discriminator to achieve the following goals:

[0194] Minimize the reconstruction loss of the decoder and improve the reconstruction ability of the feature extractor;

[0195] Maximize the classification loss of the domain discriminator, enhance the cross-domain ability of the feature extractor, and thus extract the domain-invariant feature representation;

[0196] Generate a detection threshold for the reconstruction error based on the reconstruction loss distribution of normal data;

[0197] Anomaly detection layer: After generating the original feature data from the unknown CAN bus data of the vehicle through a feature calculator, calculate the reconstruction error for the original feature data based on the feature extractor and decoder trained by the training layer; if the error exceeds the generated detection threshold, it is detected as an abnormal state;

[0198] Output layer: Output the final anomaly detection result.

[0199] Furthermore, the specific steps of step 2 include:

[0200] Step 2.1: Input the multi-dimensional original feature data marked in step 1 into the feature extractor;

[0201] Step 2.2: The feature extractor transfers the multi-dimensional original feature data marked in step 2.1 to a fully connected layer through the hidden state, and the output of the fully connected layer is further mapped to the decoder; in this embodiment, the feature extractor is used to learn the common feature intervals between data of different vehicle models, so as to extract features suitable for cross-domain anomaly detection; the input sample sets of the two domains can be represented by X S and X T respectively, where the superscripts S and T represent the source domain and the target domain respectively; for the input space and the output space the feature extractor aims to find a neural network (φ(·:w f ):χ→f) that maps the input samples to the m-dimensional feature space f; where w f =(w 1 ,w 2 ,...,w L ), w L is the network weight of the Lth hidden layer; the output of the encoder is mapped to the fully connected layer and then input to the decoder and the domain discriminator respectively;

[0202] Step 2.3: The decoder reconstructs the output of the fully connected layer in step 2.2 into multi-dimensional original feature data and generates reconstruction losses for the multi-dimensional original feature data from the source domain and the target domain; in the decoder stage of this embodiment, the embedded representation is reconstructed back to the original input record; the loss function L c of the decoder is obtained by calculating the difference between the input x i and the reconstruction output ;

[0203] Furthermore, the reconstruction loss in step 2.3 specifically includes:

[0204]

[0205] Among them, L c represents the reconstruction loss; N represents the number of samples; x i represents the original feature input data of the i-th vehicle; represents the i-th reconstructed data generated by the decoder;

[0206] The reconstruction loss is the square of the Euclidean distance between the input x i and its reconstruction , which is used to evaluate the performance of the decoder when reconstructing the input data; this loss function guides the decoder to learn to generate a reconstruction as close as possible to the original input, so as to reduce information loss;

[0207] The reconstruction loss is the degree of deviation of the original data from the trained normal behavior; a threshold is defined to identify possible anomalies. If the reconstruction loss is higher than the defined threshold, the data record is detected as an anomaly; therefore, the formula for detecting whether the given data record x i is detected as an anomaly (1) or normal (0) is as follows:

[0208] L c,i = ||x i - x' i || 2

[0209]

[0210] Among them, L c,i represents the reconstruction loss of the i-th data record; th represents the threshold; y represents the predicted label; the threshold is selected according to the 95th percentile reconstruction loss of the training data; the threshold should capture the baseline data boundary and capture the fluctuations of normal behavior, so that abnormal data will exceed this boundary and be easily detected.

[0211] Step 2.4: The domain discriminator discriminates the vehicle model based on the output of the fully connected layer in Step 2.2 and optimizes the domain discriminator classification loss in the reverse direction;

[0212] In this embodiment, the domain discriminator performs supervised domain classification on the input data and uses the label to determine the vehicle model corresponding to the input data; in the learning process of backpropagation, the classification loss of the domain discriminator will be updated to its negative value before being passed to the previous layer; through this process, the feature extractor can learn general features that prevent domain discrimination; in addition, since this training is carried out simultaneously with the training of the decoder, the features adopted not only need to be able to effectively distinguish the required categories for reconstruction, but also need to be neutral to the input domain;

[0213] Furthermore, the domain discriminator classification loss in Step 2.4 specifically includes:

[0214]

[0215] Among them, L d represents the loss function of the domain discriminator; y i represents the true label of the sample; c i represents the discrimination result of the domain discriminator on the input data; N represents the number of samples;

[0216] The autoencoder algorithm is also reflected in the training process of the entire anomaly detection model. The autoencoder algorithm is an unsupervised learning algorithm that learns an efficient representation of data through a neural network. The algorithm consists of two parts: an encoder and a decoder. Among them, the feature extractor in this embodiment is based on the encoder in the autoencoder network. The encoder is responsible for converting the input data into a lower-dimensional intermediate representation, while the decoder is responsible for restoring this intermediate representation to the original data. The training objective of the autoencoder is to minimize the difference between the input data and the reconstructed data, that is, the reconstruction error. In the anomaly detection scenario, abnormal data is a minority compared to normal data. If the difference between the output reconstructed by the autoencoder and the original input exceeds a certain threshold, the original data is abnormal;

[0217] Figure 5 is the basic architecture of the autoencoder. The architecture of the autoencoder and the number of hidden layers are determined by the application field and the usage scenario. Theoretically, given an input x, the autoencoder is trained to minimize the reconstruction loss. The relevant formula is as follows:

[0218]

[0219] Ψ: F → x',

[0220]

[0221] Among them, represents the encoding function; Ψ represents the decoding function;

[0222] Usually, the reconstruction loss of the input x represents the difference between x and x', where x' = g(f(x)). Here, f(x) is the encoding function that constructs the encoding vector of x, and g(x) is the decoding function that reconstructs x' to the initial value. The reconstruction loss is defined by a function representing the difference between the input x and the reconstructed input x'. The mean squared error (MSE) and the mean absolute error (MAE) are commonly used functions to calculate the reconstruction loss, which are respectively:

[0223]

[0224]

[0225] The autoencoder has its efficient data compression (encoding) and decompression (decoding) capabilities. Its unsupervised training process can adapt to processing raw network traffic data (unlabeled data) and effectively detect unknown network attacks;

[0226] Step 2.5: While minimizing the reconstruction loss of the decoder in Step 2.3, maximize the domain discriminator classification loss in Step 2.4, so that the feature extractor can learn domain-invariant features of different vehicle models to complete the training of the anomaly detection model;

[0227] Finally, the loss function of the entire network is:

[0228] L t = L c + λ d ·L d

[0229] where λ d represents a weight coefficient used to balance the contributions of the two loss functions;

[0230] The optimization of the training process includes two loss functions, where L c is the reconstruction loss (for the main task), and L d is the domain discriminator classification loss; the reconstruction loss and the domain discriminator classification loss compete with each other in an adversarial manner. When the optimization process converges, the reconstruction loss on the source domain is minimized, while the domain discriminator classification loss is maximized; this maximization is achieved by changing the sign of the gradient from the domain classification layer to the feature representation layer; therefore, the update of the feature representation parameters is in the opposite direction of the gradient. By using the stochastic gradient descent method, it attempts to maintain the consistency of cross-domain features, ensuring that the knowledge learned from the source domain is still valid for the target domain without performance loss;

[0231] Step 3: The cloud server distributes the anomaly detection model trained in Step 2 to the roadside unit through edge computing;

[0232] Furthermore, Step 3 specifically includes:

[0233] Step 3.1: The cloud server packages the trained anomaly detection model into a format suitable for deployment on the roadside unit to prepare for subsequent distribution and deployment;

[0234] Step 3.2: The cloud server selects a suitable roadside unit to distribute the anomaly detection model according to the computing power, network status, and task requirements of the edge node.

[0235] Furthermore, Step 3.2 specifically includes:

[0236] Step 3.2.1: Evaluation of the computing power and network status of the edge node

[0237] The cloud server collects and records in real time the CPU performance, memory resources, GPU resources, bandwidth, latency, packet loss rate of the roadside unit, as well as the number of tasks and resource occupancy rate of the node.

[0238] Step 3.2.2: Task requirement analysis and node matching

[0239] According to the complexity of the anomaly detection model to be distributed, the inference time limit, and the network latency tolerance, the cloud server establishes an evaluation model, performs the adaptability matching between the roadside unit and the task requirements, calculates the adaptation score of each node, and determines the priority ranking; the specific evaluation model is:

[0240] Score=w 1 ×S 复杂度 +w 2 ×S 推理时间 +w 3 ×S 网络延迟

[0241] Where S 复杂度 is the number of parameters, computational complexity, and memory size of the anomaly detection model; S 推理时间 is the inference time; S 网络延迟 is the network latency; w 1 , w 2 , w 3 are weight coefficients, and w 1 +w 2 +w 3 =1;

[0242] Step 3.2.3: Optimal node selection and model distribution

[0243] The cloud server selects the roadside unit with the highest ranking as the model deployment target according to the adaptation ranking result, and pushes the anomaly detection model to the corresponding roadside unit.

[0244] In this embodiment, edge computing, as a new technology that integrates mobile access networks and Internet services, sinks computing power to edge nodes, which is closer to the user side than the core cloud, and can save bandwidth and reduce the latency of users processing data.

[0245] Step 4: The vehicle extracts multi-dimensional original features of unknown CAN bus data in real time and uploads them to the roadside unit in Step 3 for online anomaly detection;

[0246] As Figure 6 shown, the roadside unit receives the multi-dimensional original features of the unknown CAN bus data extracted from the vehicle side, and uses the trained anomaly detection model carried on the roadside unit for real-time detection, and finally outputs the anomaly detection result.

[0247] Figure 7 This is a specific implementation case of CAN bus anomaly detection in the present invention. The process is overall divided into an offline training stage and an online detection stage of the model:

[0248] Offline training stage of the model: First, the normal CAN bus datasets of vehicle model 1 and vehicle model 2 are input into the cloud server, and the CAN data frames in the CAN bus dataset are sorted according to the time series; then the cloud server extracts CAN data frames based on the idea of a sliding window, performs feature extraction on the time dimension, arbitration field, and data field of the CAN data frames, and then inputs them into the anomaly detection model; the feature extractor of the anomaly detection model maps multi-dimensional original features to a low-dimensional feature space (Embedding), and the domain discriminator classifies the low-dimensional feature space and discriminates the vehicle model; at the same time, the decoder attempts to reconstruct the low-dimensional feature space into the original features, and through adversarial training, the feature extractor tries to generate a low-dimensional feature space that can confuse the domain discriminator to achieve domain adaptation;

[0249] Online detection stage: Finally, the trained anomaly detection model is sent to the roadside unit, and the roadside unit performs online detection on the multi-dimensional original features of the unknown CAN bus data extracted from the vehicle to be detected.

[0250] Figure 8 This is the architecture diagram of the anomaly detection method for cloud-edge-vehicle collaboration in the present invention; according to the different functions of the members, the architecture diagram can be divided into a cloud server, a roadside unit, and a vehicle end. The tasks of the cloud server, roadside unit, and vehicle in the anomaly detection process in the architecture diagram are as follows:

[0251] Cloud server: Responsible for offline training of the anomaly detection model, integrating normal CAN bus data of different vehicle models, extracting unified features across vehicle models through adversarial domain adaptation technology, and completing the training and optimization of the model; the trained model will be sent to the roadside unit (RSU) to provide support for subsequent real-time detection;

[0252] Roadside unit: Deploy the anomaly detection model trained in the cloud and receive the original feature data uploaded by the vehicle; on the edge device, the roadside unit uses the deployed model to perform real-time anomaly detection on the data, and after the processing is completed, it feeds back the detection result to the vehicle to help the vehicle identify abnormal behaviors;

[0253] Vehicle: The vehicle is responsible for real-time extraction of multi-dimensional original features of unknown CAN bus data, uploading the extracted feature data to the nearby roadside unit for processing; in addition, the vehicle receives the detection result sent by the roadside unit to achieve a quick response to abnormal behaviors.

[0254] The following describes the application effect of the present invention in detail in combination with simulation experiments.

[0255] The experimental environment is shown in Table 2. The dataset uses the public dataset Survival Analysis Dataset for automobile IDS from the HACKING AND COUNTERMEASURE RESEARCH LAB, which contains normal and abnormal driving data in three different types of vehicles: Soul, Spark, and Sonata. The abnormal data contains three types of attacks: Flooding, Fuzzing, and Malfunction. Through a series of experiments, the effectiveness of the present invention in cross - vehicle anomaly detection is verified.

[0256] Table 2 Experimental Environment

[0257] Operating System Windows 11 Memory 2*16G Graphics Card (Video Memory) GTX 3050 Ti (12G) Emulation Environment Python 3.8, Pytorch 2.1.2

[0258] Evaluating the effectiveness of the scheme

[0259] Figure 9 During the experiment, in order to verify the relationship graph between the size of the sliding window of the CAN data frame sequence and the accuracy rate, where the vertical coordinate is the accuracy rate and the horizontal coordinate is the window size; it can be seen from Figure 9 that either too large or too small a sliding window will affect the accuracy rate of the model detection. Based on the experimental results, when the window size is 80, the detection model has the best detection effect on the CAN data frame attacks. Therefore, this scheme will use a window size of 80 for the experiment.

[0260] By using this scheme to perform anomaly detection on the data of different vehicle models, the rationality of the proposed adversarial domain - adaptive anomaly detection scheme of the present invention is verified.

[0261] Table 3 shows the anomaly detection results of the anomaly detection model obtained without adversarial domain - adaptive training on the Spark normal dataset when detecting in the cross - vehicle anomaly dataset; the anomaly datasets of the three vehicle models Spark, Soul, and Sonata contain flooding attacks, fuzzing attacks, and imitation attacks; the results show that the cross - domain detection accuracy rates of the Soul and Sonata vehicle models have decreased to varying degrees.

[0262] Table 3 Anomaly Detection Results of the AE Model

[0263] Vehicle Model Accuracy Precision Recall F1 Score Spark 0.9658 0.9296 0.9992 0.9631 Sonata 0.8265 0.7263 0.9988 0.8410 Soul 0.9281 0.9996 0.8655 0.9278

[0264] Table 4 shows that when the anomaly detection model with adversarial domain - adaptation performs cross - vehicle anomaly detection, the detection accuracy rate for Sonata anomaly data increases from 0.8265 to 0.9486, and the detection accuracy rate for Soul anomaly data increases from 0.9281 to 0.9543, meeting the experimental expectations.

[0265] Table 4 Abnormal detection results of the AE model under adversarial domain adaptation

[0266] Vehicle Model Accuracy Precision Recall F1 Score Spark 0.9871 0.9878 0.9868 0.9873 Sonata 0.9486 0.9048 0.9566 0.8267 Soul 0.9543 0.9462 0.9428 0.9264

[0267] To better show the differences in data distribution between different vehicle models, this experiment uses t-distributed Stochastic Neighbor Embedding (t-SNE) to visualize the data characteristics of normal driving on the CAN buses of Soul and Sonata vehicles; as Figure 10 shown, most of the red dots and green dots are distributed at different positions, which is due to the differences in data distribution between the two vehicle models; therefore, the abnormal detection model trained on one vehicle model cannot be applied to other vehicle models; as Figure 11 shown, after the feature mapping of adversarial domain adaptation proposed by the present invention, most of the red dots and green dots are distributed at the same position after mapping, which indicates that the abnormal detection model trained with the mapped feature data can be applied to different vehicle models.

[0268] Table 5 shows the detection effects of the abnormal detection model trained in the present invention under different attacks; for Flooding attack and Fuzzy attack, it has a very high detection accuracy, reaching 0.9916 and 0.9884 respectively, and for the relatively complex Malfunction attack, the accuracy also reaches 0.9412, which shows that the present invention has good detection effects on different types of attacks.

[0269] Table 5 Detection effects of the abnormal detection model trained in the present invention under different attacks

[0270] Attack Type Accuracy Precision Recall F1 Score Flooding 0.9916 0.9896 0.9986 0.9834 Fuzzy 0.9884 0.9899 0.9855 0.9863 Malfunction 0.9412 0.9657 0.8943 0.9286

[0271] Figure 12 Shows the comparison of the attack detection effects of three detection methods on different vehicle model datasets; the results show that the method proposed in the present invention has better attack detection effects on different vehicle model data than the other two comparison methods; especially when performing cross-vehicle detection, after domain adaptation training, the method proposed in the present invention has significantly better detection effects on Soul vehicle model and Spark vehicle model than the existing Autoencoder (AE) and CANet schemes, and this result fully verifies the effectiveness of the method of the present invention.

[0272] Evaluation of the efficiency of the solution

[0273] Table 6 Size of the abnormal detection model and time required for detection

[0274] Storage Space Detection Time 30.1 MB 0.11 Milliseconds

[0275] Table 6 shows that the storage space of the anomaly detection model trained by the present invention is 30.1 MB, and the detection time for each CAN bus data is 0.11 milliseconds. It can be seen that this solution can meet the communication requirements of in-vehicle CAN buses in terms of computing efficiency. At the same time, since the model is deployed in the road test unit, its storage space also fully meets the requirements of anomaly detection. This enables the solution of the present invention to well adapt to the requirements of real-time performance and limited resources in the vehicle networking environment, providing an efficient and feasible solution for CAN bus security protection.

[0276] The above embodiments are only detailed descriptions of the present invention, but the present invention is not limited to the above embodiments. Any modifications, substitutions, and changes made within the spirit and scope of the claims of the present invention are within the protection scope of the present invention.

Claims

1. A method for detecting abnormal traffic on a CAN bus, characterized in that: The following steps are involved: Step 1: The cloud server extracts multi-dimensional original features from normal CAN bus data sets of different models and labels the extracted multi-dimensional original features; Step 2: The cloud server uses the domain adversarial adaptive network to input the multi-dimensional original feature data annotated in step 1 into the anomaly detection model for training; Step 3: The cloud server sends the anomaly detection model trained in step 2 to the roadside unit through edge computing; Step 4: The vehicle extracts the multi-dimensional original features of the unknown CAN bus data in real time and uploads them to the roadside unit in step 3 for online anomaly detection.

2. The abnormal traffic detection method for CAN bus according to claim 1 is characterized in that: The step 1 specifically includes: Step 1.1: The cloud server collects and integrates normal CAN bus data sets of different vehicle models; Step 1.2: The cloud server sorts the data frames in the normal CAN data set in step 1.1 according to the time series, and extracts the CAN data frames in the sliding window; Step 1.3: In the sliding window of step 1.2, use Hamming distance, Hamming weight, and cosine similarity to extract features from the time dimension, arbitration field, and data field of the CAN data frame respectively to obtain the original multi-dimensional feature data set of the sliding window. Step 1.4: Label the original multi-dimensional feature dataset in step 1.3 with the corresponding vehicle models.

3. The abnormal traffic detection method for CAN bus according to claim 2 is characterized in that: The step 1.2 specifically includes: Determine the sliding window size as n, and use CAN1 as the first CAN data frame in the sliding window. n As the end frame, the CAN data frame sequence is: CAN series ={CAN1,CAN2...,CAN n } Extract the timestamp, arbitration field, and data field from each CAN data frame within the window, and convert the hexadecimal in the arbitration field and data field into binary.

4. The abnormal traffic detection method for CAN bus according to claim 2 is characterized in that: The step 1.3 specifically includes: Step 1.3.1: Feature extraction in the time dimension Definition i is the timestamp of each CAN data frame in the window, and calculates the timestamp t of each CAN data frame in the window. i The timestamp of the previous CAN data frame is i-1 The interval, that is, the time difference between adjacent CAN data frames is: Δt i =t i -t i-1 Step 1.3.2: Feature extraction of arbitration field The arbitration field of each CAN data frame in the definition window is id, which consists of 11 bits of binary: id={d1,d2,...,d 11 } d i ∈{0,1} The Hamming weight of the arbitration field of the CAN data frame is calculated as: Define the arbitration field of the current CAN data frame as id i , the arbitration field of the data frame adjacent to the current CAN data frame is id i-1 , then the Hamming distance of the arbitration fields of adjacent CAN data frames is: Among them, id i [j]∈{0,1} represents the arbitration field id i The j-th value of the 11-bit binary sequence; Represents a bitwise exclusive OR operation; Calculate the frequency of occurrence of the arbitration field of each CAN data frame within the window: Among them, N i Indicates the number of arbitration fields of the data frame in the window that are the same as the arbitration field of the current CAN data frame; n indicates the window size; Step 1.3.3: Feature extraction of data fields The data field consists of several bytes, the number of which is determined by the DLC; the binary form of the data field of the CAN data frame is defined as follows: data={d1,d2,...,d 8·DLC } d i ∈{0,1} The Hamming weight of the data field of the CAN data frame is calculated as: Define the data field of the current CAN data frame as data i , the data field of the previous CAN data frame in the window is data i-1 , then the Hamming distance between the data fields of adjacent CAN data frames is: Among them, data i [j]∈{0,1} represents the data field data i The value of the jth bit in the 64-bit binary sequence of the data field; if the length of the data field is less than 64 bits, the missing bits need to be filled with 0 before calculation; Find the data frame in the sequence that has the same arbitration field as the current CAN data frame and is closest to it. If the data frame is found, calculate the Hamming distance D between the data field of the current data frame and the data frame. s , that is, the Hamming distance of the data field of the CAN data frame with the same arbitration field is: Among them, data i Represents the data field of the current CAN data frame; data s Indicates the data field of the data frame that is closest to the current CAN data frame and has the same data field; if there is no CAN data frame with the same arbitration field, the corresponding distance feature will be set to 0 to avoid missing values; Calculate the information entropy of the data field of the CAN data frame: Among them, p i Represents the data frame data i The probability of 0 or 1 appearing; Step 1.3.4: Based on the time difference Δt of adjacent CAN data frames in step 1.3.1 i , the Hamming weight hw of the arbitration field of the CAN data frame in step 1.3.2 id , the Hamming distance of the arbitration fields of adjacent CAN data frames The frequency of the arbitration field in the CAN data frame The Hamming weight hw of the data field of the CAN data frame in step 1.3.3 data , the Hamming distance D between the data fields of adjacent CAN data frames i , the Hamming distance D of the data field of the nearest CAN data frame with the same arbitration field s , the information entropy of the data field of the CAN data frame constructs a multi-dimensional original feature data set of the CAN bus.

5. The abnormal traffic detection method for CAN bus according to claim 1 is characterized in that: The anomaly detection model in step 2 specifically includes: Feature calculator: calculates the original feature data of the vehicle CAN bus dataset and provides input for the feature extractor; Feature extractor: maps the original feature data into the latent feature space and generates latent feature representation; Decoder: reconstructs the latent feature representation output by the feature extractor into the original feature data; Domain discriminator: Symmetric to the feature extractor, used to reconstruct the latent feature representation output by the feature extractor into the original feature data; Training layer: The normal CAN bus data of different models is used to generate original feature data through the feature calculator, and then the feature extractor, decoder and domain discriminator are combined for joint optimization to achieve the following goals: Minimize the reconstruction loss of the decoder and improve the reconstruction ability of the feature extractor; Maximize the classification loss of the domain discriminator and enhance the cross-domain capability of the feature extractor, thereby extracting domain-invariant feature representations; Generate a detection threshold of reconstruction error based on the reconstruction loss distribution of normal data; Abnormal detection layer: After the unknown CAN bus data of the vehicle is generated into raw feature data by the feature calculator, the reconstruction error of the raw feature data is calculated based on the feature extractor and decoder trained in the training layer; if the error exceeds the generated detection threshold, it is detected as an abnormal state; Output layer: Outputs the final anomaly detection results.

6. The abnormal traffic detection method for CAN bus according to claim 1 or 5, characterized in that: The step 2 specifically includes: Step 2.1: Input the multi-dimensional original feature data annotated in step 1 into the feature extractor; Step 2.2: The feature extractor passes the multi-dimensional original feature data annotated in step 2.1 to a fully connected layer through the hidden state, and the output of the fully connected layer is further mapped to the decoder; Step 2.3: The decoder reconstructs the output of the fully connected layer in step 2.2 into multi-dimensional raw feature data and generates reconstruction losses for the multi-dimensional raw feature data from the source domain and the target domain; Step 2.4: The domain discriminator discriminates the vehicle type based on the output of the fully connected layer in step 2.2, and optimizes the classification loss of the domain discriminator in reverse; Step 2.5: While minimizing the reconstruction loss of the decoder in step 2.3, maximize the classification loss of the domain discriminator in step 2.4, so that the feature extractor learns domain-invariant features of different car models to complete the training of the anomaly detection model.

7. The abnormal traffic detection method for CAN bus according to claim 6 is characterized in that: The reconstruction loss in step 2.3 specifically includes: Among them, L c represents the reconstruction loss; N represents the number of samples; x i Represents the original feature input data of the i-th vehicle; Represents the i-th reconstructed data generated by the decoder.

8. The abnormal traffic detection method for CAN bus according to claim 6 is characterized in that: The domain discriminator classification loss in step 2.4 specifically includes: Among them, L d represents the loss function of the domain discriminator; y i represents the true label of the sample; c i represents the discrimination result of the domain discriminator on the input data; N represents the number of samples.

9. The abnormal traffic detection method for CAN bus according to claim 1 is characterized in that: The step 3 specifically includes: Step 3.1: The cloud server packages the trained anomaly detection model into a format suitable for roadside unit deployment, preparing for subsequent distribution and deployment; Step 3.2: The cloud server selects the appropriate roadside unit to send the anomaly detection model based on the computing power, network status and task requirements of the edge node.

10. The abnormal traffic detection method for CAN bus according to claim 9, characterized in that: The step 3.2 specifically includes: Step 3.2.1: Evaluation of edge node computing power and network status The cloud server collects and records the roadside unit’s CPU performance, memory resources, GPU resources, bandwidth, latency, packet loss rate, and the number of tasks and resource usage of the node in real time; Step 3.2.2: Task requirement analysis and node matching According to the complexity of the anomaly detection model to be issued, the inference time limit and the network delay tolerance, the cloud server establishes an evaluation model to match the adaptability of the roadside unit with the task requirements, calculates the adaptability score of each node, and determines the priority ranking; Step 3.2.3: Optimal node selection and model delivery The cloud server selects the roadside unit with the highest ranking as the model deployment target based on the fitness ranking results, and pushes the anomaly detection model to the corresponding roadside unit.

Images