A method for detecting abnormal traffic for a CAN bus

Abstract

A kind of abnormal flow detection method for CAN bus, including cloud server carries out multidimensional original feature extraction to the normal CAN bus data set of different vehicle models, and the multidimensional original feature extracted is labeled;Cloud server trains by inputting the multidimensional original feature data labeled into abnormal detection model by domain-adversarial neural network;Cloud server distributes the abnormal detection model trained to roadside unit by edge computing;Vehicle real-time extracts the multidimensional original feature of unknown CAN bus data, and uploads to roadside unit for online anomaly detection;The method solves the deficiencies of existing CAN bus anomaly detection in identifying multiple attack behaviors, cross-vehicle generality and vehicle-mounted computing resource pressure, has the characteristics of improving detection accuracy and comprehensiveness, enhancing model generalization ability and adaptability, optimizing resource utilization and improving system performance.

Description

Technical Field

[0001] This invention relates to the field of vehicle information security technology, specifically to a method for detecting abnormal traffic on a CAN bus. Background Technology

[0002] With the continuous development of network communication technology, the Internet of Things (IoT) and the Internet of Vehicles (IoV) technologies are rapidly evolving. Modern vehicles are gradually becoming network-controlled vehicles, including autonomous vehicles (AVs) and connected vehicles (CVs). A typical IoV system is divided into an in-vehicle network (IVN) and an external network. The Controller Area Network (CAN) bus is an important in-vehicle network communication protocol. Due to its high reliability, anti-interference capabilities, and low cost, the CAN bus is widely used in modern automobiles for information exchange between various Electronic Control Units (ECUs). However, because the CAN bus uses broadcast communication and lacks any inherent security mechanisms, it is highly susceptible to message injection attacks. Furthermore, with the continuous development of in-vehicle Bluetooth, Wi-Fi, and mobile cellular network technologies, vehicle network connectivity and accessibility have significantly improved. This makes the CAN bus even more vulnerable to network attacks from both internal and external sources. Attackers can attack the CAN bus through physical means such as USB interfaces and On-Board Diagnostics (OBD-II) interfaces, or by utilizing wireless interfaces such as Bluetooth and Wi-Fi. Such attacks could not only lead to the leakage of car owners' privacy data, but more seriously, they pose a significant threat to the personal safety of car owners.

[0003] Currently, security defense strategies for the CAN bus mainly fall into two categories. One is an active defense strategy based on encryption and authentication. This strategy encrypts plaintext messages transmitted on the CAN bus and authenticates the sender to achieve proactive protection. However, due to the limited length of CAN message frames, encryption and authentication operations significantly increase the load on the CAN bus, further reducing the available bandwidth of normal data frames and impacting system performance. The other category is CAN bus anomaly detection technology. Anomaly detection is a protection method that does not require modification of the CAN bus protocol. Currently, anomaly detection schemes for the CAN bus mainly rely on machine learning-trained models. However, current solutions still have the following three main problems: 1. They rely on only a single dimension of features, such as time series, data frame content, or physical layer characteristics, resulting in limited effectiveness in identifying various complex attack behaviors. 2. Due to differences in the structure and meaning of CAN data frames among different vehicle manufacturers, the anomaly detection models have low universality across different vehicle models. 3. Detection models are usually deployed directly on the vehicle, which increases the pressure on onboard computing resources.

[0004] Patent application CN116827641 A discloses a method and system for detecting and tracing abnormal traffic on a vehicle CAN bus. This method solves the technical problem that existing vehicle network anomaly detection methods cannot trace abnormal ECUs by combining graph convolutional networks (GCN), node feature matrices, feature adjacency matrices, and a CAN ID-ECU mapping table, achieving accurate ECU localization. However, this method only establishes features for CAN IDs, failing to fully utilize multi-dimensional information and limiting the detection capability for complex attack behaviors. Furthermore, it does not consider the data distribution differences between different vehicle models, resulting in low cross-vehicle compatibility, and it does not address the model deployment issue. Summary of the Invention

[0005] To overcome the shortcomings of the existing technology, the present invention aims to provide an abnormal traffic detection method for CAN bus. This method extracts multi-dimensional original features from normal CAN bus datasets of different vehicle models, uses a domain adversarial adaptive network to input the multi-dimensional original feature data into an anomaly detection model for training, and deploys the trained anomaly detection model to roadside units for anomaly detection through edge computing. This method solves the shortcomings of existing CAN bus anomaly detection in identifying various attack behaviors, cross-vehicle universality, and reducing the pressure on on-board computing resources. It features improved detection accuracy and comprehensiveness, enhanced model generalization and adaptability, optimized resource utilization, and improved system performance.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] An abnormal traffic detection method for a CAN bus includes the following steps:

[0008] Step 1: The cloud server extracts multi-dimensional raw features from the normal CAN bus datasets of different vehicle models and labels the extracted multi-dimensional raw features;

[0009] Step 2: The cloud server inputs the labeled multi-dimensional raw feature data from Step 1 into the anomaly detection model for training through a domain adversarial adaptive network;

[0010] Step 3: The cloud server distributes the anomaly detection model trained in Step 2 to the roadside unit via edge computing;

[0011] Step 4: The vehicle extracts multi-dimensional raw features of unknown CAN bus data in real time and uploads them to the roadside unit in Step 3 for online anomaly detection.

[0012] Furthermore, step 1 specifically includes:

[0013] Step 1.1: The cloud server collects and integrates normal CAN bus datasets from different vehicle models;

[0014] Step 1.2: The cloud server sorts the data frames in the normal CAN dataset from Step 1.1 according to the time series and extracts the CAN data frames within the sliding window;

[0015] Step 1.3: Within the sliding window of Step 1.2, features are extracted from the time dimension, arbitration field, and data field of the CAN data frame using Hamming distance, Hamming weight, and cosine similarity, respectively, to obtain the original multi-dimensional feature dataset of the sliding window.

[0016] Step 1.4: Label the original multi-dimensional feature dataset from Step 1.3 with the corresponding vehicle models.

[0017] Further, step 1.2 specifically includes:

[0018] The sliding window size is determined to be n. Within the sliding window, CAN1 is used as the first CAN data frame. n As the final frame, the CAN data frame sequence is as follows:

[0019] CAN series ={CAN1,CAN2,...,CAN n}

[0020] Extract the timestamp, arbitration field, and data field from each CAN data frame within the window, and convert the hexadecimal values ​​in the arbitration field and data field into binary.

[0021] Furthermore, step 1.3 specifically includes:

[0022] Step 1.3.1: Feature Extraction in the Time Dimension

[0023] Define t i Calculate the timestamp t for each CAN data frame within the window. i Timestamp t of the previous CAN data frame i-1 The interval, i.e., the time difference between adjacent CAN data frames, is:

[0024] Δt i =t i -t i-1

[0025] Step 1.3.2: Feature Extraction of the Arbitration Field

[0026] Define the arbitration field as id for each CAN data frame within the window, which consists of 11 bits of binary data:

[0027] id = {d1, d2, ..., d 11}

[0028] d i ∈{0,1}

[0029] The Hamming weight of the arbitration field of the CAN data frame is calculated as follows:

[0030]

[0031] Define the arbitration field of the current CAN data frame as id. i The arbitration field of the data frame adjacent to the current CAN data frame is id. i-1 Then the Hamming distance in the arbitration field of adjacent CAN data frames is:

[0032]

[0033] Among them, id i [j]∈{0,1} represents the arbitration field id. i The value of the j-th bit in an 11-bit binary sequence; Indicates a bitwise XOR operation;

[0034] Calculate the frequency of the arbitration field in each CAN data frame within the calculation window:

[0035]

[0036] Where, N i This indicates the number of arbitration fields in the window that are identical to the arbitration field of the current CAN data frame; n represents the window size.

[0037] Step 1.3.3: Feature Extraction of Data Fields

[0038] The data field consists of several bytes, the number of which is determined by the DLC; the binary form of the data field defining the CAN data frame is as follows:

[0039] data={d1,d2,...,d 8·DLC}

[0040] d i ∈{0,1}

[0041] The Hamming weight of the data field in the CAN data frame is calculated as follows:

[0042]

[0043] Define the data field of the current CAN data frame as data. i The data field of the previous CAN data frame in the window is data. i-1 Then the Hamming distance between the data fields of adjacent CAN data frames is:

[0044]

[0045] Among them, data i [j]∈{0,1} represents the data field data i The value of the j-th bit in the 64-bit binary sequence; if the length of the data field is less than 64 bits, missing bits need to be padded with 0 before calculation;

[0046] Find the nearest data frame in the sequence that has the same arbitration field as the current CAN data frame. If such a data frame is found, calculate the Hamming distance D between the data fields of the current data frame and that data frame. s That is, the Hamming distance between the data fields of the most recent CAN data frames with the same arbitration field is:

[0047]

[0048] Among them, data i This indicates the data field of the current CAN data frame; data s This indicates the data field of the data frame that is closest to the current CAN data frame and has the same data field. If there is no CAN data frame with the same arbitration field, the corresponding distance feature will be set to 0 to avoid missing values.

[0049] Calculate the information entropy of the data fields in a CAN data frame:

[0050]

[0051] Where pi represents the data frame. i The probability of 0 or 1 appearing in the middle;

[0052] Step 1.3.4: Based on the time difference Δt between adjacent CAN data frames in Step 1.3.1 i In step 1.3.2, the Hamming weight hw in the arbitration field of the CAN data frame id Hamming distance D in the arbitration field of adjacent CAN data frames idi Frequency of occurrence of the arbitration field in CAN data frames In step 1.3.3, the Hamming weight hw in the data field of the CAN data frame data Hamming distance D between the data fields of adjacent CAN data frames i Hamming distance D of the data fields in the most recent CAN data frame with the same arbitration field s The information entropy of the data fields in the CAN data frame is used to construct a multi-dimensional raw feature dataset for the CAN bus.

[0053] Furthermore, the anomaly detection model in step 2 specifically includes:

[0054] Feature Calculator: Calculates the raw feature data of the vehicle CAN bus dataset, providing input for the feature extractor;

[0055] Feature extractor: maps raw feature data to a latent feature space to generate latent feature representations;

[0056] Decoder: Reconstructs the latent feature representation output by the feature extractor into the original feature data;

[0057] Domain discriminator: Symmetric to the feature extractor, used to reconstruct the latent feature representation output by the feature extractor into the original feature data;

[0058] Training layer: Normal CAN bus data from different vehicle models are used to generate raw feature data through a feature calculator. Then, the feature extractor, decoder, and domain discriminator are combined to jointly optimize and achieve the following objectives:

[0059] Minimize the reconstruction loss of the decoder to improve the reconstruction capability of the feature extractor;

[0060] Maximize the classification loss of the domain discriminator to enhance the cross-domain capability of the feature extractor, thereby extracting domain-invariant feature representations;

[0061] Based on the reconstruction loss distribution of normal data, a detection threshold for reconstruction error is generated;

[0062] Anomaly Detection Layer: After generating raw feature data from the unknown CAN bus data of the vehicle using a feature calculator, the reconstruction error is calculated based on the feature extractor and decoder trained in the training layer. If the error exceeds the generated detection threshold, it is detected as an anomaly.

[0063] Output layer: Outputs the final anomaly detection results.

[0064] Furthermore, step 2 specifically includes:

[0065] Step 2.1: Input the labeled multi-dimensional raw feature data from Step 1 into the feature extractor;

[0066] Step 2.2: The feature extractor passes the annotated multi-dimensional raw feature data from Step 2.1 through the hidden state to a fully connected layer, and the output of the fully connected layer is further mapped to the decoder;

[0067] Step 2.3: The decoder reconstructs the output of the fully connected layer in Step 2.2 into multi-dimensional original feature data, and generates a reconstruction loss for the multi-dimensional original feature data from the source domain and the target domain;

[0068] Step 2.4: The domain discriminator determines the vehicle type based on the output of the fully connected layer in Step 2.2, and optimizes the classification loss of the domain discriminator by backpropagation;

[0069] Step 2.5: While minimizing the reconstruction loss of the decoder in Step 2.3, maximize the classification loss of the domain discriminator in Step 2.4, so that the feature extractor learns the domain-invariant features of different vehicle models, thereby completing the training of the anomaly detection model.

[0070] Furthermore, the reconstruction loss in step 2.3 specifically includes:

[0071]

[0072] Among them, L c Represents the reconstruction loss; N represents the number of samples; x i This represents the original feature input data for the i-th vehicle; This represents the i-th reconstructed data generated by the decoder.

[0073] Furthermore, the classification loss of the domain discriminator in step 2.4 specifically includes:

[0074]

[0075] Among them, L d The loss function of the domain discriminator; y i Indicates the true label of the sample; c iThe domain discriminator's judgment result on the input data; N represents the number of samples.

[0076] Furthermore, step 3 specifically includes:

[0077] Step 3.1: The cloud server packages the trained anomaly detection model into a format suitable for roadside unit deployment, preparing it for subsequent distribution and deployment;

[0078] Step 3.2: The cloud server selects appropriate roadside units to distribute the anomaly detection model based on the computing power, network status, and task requirements of the edge nodes.

[0079] Furthermore, step 3.2 specifically includes:

[0080] Step 3.2.1: Evaluation of edge node computing power and network status

[0081] The cloud server collects and records in real time the CPU performance, memory resources, GPU resources, bandwidth, latency, packet loss rate, and the number of tasks and resource utilization of the roadside units;

[0082] Step 3.2.2: Task Requirements Analysis and Node Matching

[0083] Based on the complexity, inference time constraints, and network latency tolerance of the anomaly detection model to be issued, the cloud server establishes an evaluation model to match the adaptability of roadside units with task requirements, calculates the adaptability score of each node, and determines the priority ranking.

[0084] Step 3.2.3: Optimal Node Selection and Model Deployment

[0085] Based on the adaptation ranking results, the cloud server selects the highest-ranked roadside unit as the model deployment target and pushes the anomaly detection model to the corresponding roadside unit.

[0086] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0087] 1. This invention extracts multi-dimensional raw features from normal CAN bus datasets of different vehicle models using a cloud server. This solves the problem that existing anomaly detection schemes rely on only a single-dimensional feature, resulting in limited effectiveness in identifying various complex attack behaviors. It achieves the ability to detect multiple types of attacks and has the characteristics of improving detection accuracy and comprehensiveness.

[0088] 2. This invention feeds multi-dimensional raw feature data into the anomaly detection model for training through a domain adversarial adaptive network, which solves the problem of low universality of anomaly detection models across different vehicle models, and obtains cross-vehicle anomaly detection capability, with the characteristics of enhancing the model's generalization ability and adaptability.

[0089] 3. This invention deploys the trained anomaly detection model to roadside units for anomaly detection through edge computing, which solves the problem of increasing the pressure on vehicle computing resources when the detection model is directly deployed on the vehicle. It achieves the effect of significantly reducing the burden on vehicle computing resources and has the characteristics of optimizing resource utilization and improving system performance.

[0090] In summary, this invention addresses the shortcomings of existing CAN bus anomaly detection methods in identifying various attack behaviors, cross-vehicle generality, and reducing onboard computing resource pressure by extracting multi-dimensional original features from normal CAN bus datasets of different vehicle models, using a domain adversarial adaptive network to input the multi-dimensional original feature data into the anomaly detection model for training, and deploying the trained anomaly detection model to roadside units for anomaly detection through edge computing. Attached Figure Description

[0091] Figure 1 This is a flowchart of an abnormal traffic detection method for the CAN bus.

[0092] Figure 2 This is a sequence of CAN data frames captured by a sliding window.

[0093] Figure 3 For domain adversarial adaptive neural networks.

[0094] Figure 4 This is a basic structural diagram of the anomaly detection model.

[0095] Figure 5 This is a basic architecture diagram of an autoencoder.

[0096] Figure 6 This is a schematic diagram of anomaly detection.

[0097] Figure 7 This is a flowchart illustrating the offline training and online detection of an anomaly detection model.

[0098] Figure 8 This is a diagram of the anomaly detection architecture for cloud-edge-vehicle collaboration.

[0099] Figure 9 This illustrates the impact of window size on the accuracy of the anomaly detection model.

[0100] Figure 10 This represents the characteristic distribution of normal data for the Soul and Sonata models.

[0101] Figure 11 The feature distribution of Soul and Sonata models after training.

[0102] Figure 12The curves show the cross-vehicle detection performance of three different detection schemes based on the present invention: the self-encoder (AE) scheme and the CANet scheme. Detailed Implementation

[0103] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments:

[0104] To address the problems of existing CAN bus anomaly detection schemes relying on single features, poor model versatility, and increased computational burden due to in-vehicle deployment, this invention proposes an anomaly traffic detection method for the CAN bus based on domain adversarial adaptive cloud-edge-vehicle collaboration and edge computing. Figure 1 As shown, it includes the following steps:

[0105] Step 1: The cloud server extracts multi-dimensional raw features from the normal CAN bus datasets of different vehicle models and labels the extracted multi-dimensional raw features;

[0106] This embodiment ensures that the normal CAN bus data of various vehicle models are not affected by abnormal attack data during subsequent training by pre-storing normal CAN bus data on a cloud server, thereby improving the security of the entire system. At the same time, by extracting useful feature information from the CAN bus dataset, it is easier to train the subsequent anomaly detection model more effectively.

[0107] Furthermore, step 1 specifically includes:

[0108] Step 1.1: The cloud server collects and integrates normal CAN bus datasets from different vehicle models;

[0109] Step 1.2: The cloud server sorts the data frames in the normal CAN dataset from Step 1.1 according to the time series and extracts the CAN data frames within the sliding window;

[0110] Further, step 1.2 specifically includes:

[0111] The sliding window size is determined to be n. Within the sliding window, CAN1 is used as the first CAN data frame. n As the final frame, the CAN data frame sequence is as follows:

[0112] CAN series ={CAN1,CAN2,...,CAN n}

[0113] like Figure 2 As shown, extract the timestamp, arbitration field, and data field from each CAN data frame within the window, and convert the hexadecimal values ​​in the arbitration field and data field into binary.

[0114] Step 1.3: Within the sliding window of Step 1.2, features are extracted from the time dimension, arbitration field, and data field of the CAN data frame using Hamming distance, Hamming weight, and cosine similarity, respectively, to obtain the original multi-dimensional feature dataset of the sliding window;

[0115] Furthermore, step 1.3 specifically includes:

[0116] Step 1.3.1: Feature Extraction in the Time Dimension

[0117] Define t i Calculate the timestamp t for each CAN data frame within the window. i Timestamp t of the previous CAN data frame i-1 The interval, i.e., the time difference between adjacent CAN data frames, is:

[0118] Δt i =t i -t i-1

[0119] Using the time interval as a feature of the time dimension, after calculation, the starting frame time interval within the window is set to 0; then the final time interval feature sequence within a window is:

[0120] (0,Δt1,Δt2,...,Δt n )

[0121] Step 1.3.2: Feature Extraction of the Arbitration Field

[0122] Define the arbitration field as id for each CAN data frame within the window, which consists of 11 bits of binary data:

[0123] id = {d1, d2, ..., d 11}

[0124] d i ∈{0,1}

[0125] The Hamming weight of the arbitration field of the CAN data frame is calculated as follows:

[0126]

[0127] In this embodiment, Hamming weight is an indicator of the number of non-zero elements (usually 1) in a string, and also the number of 1s in the string. The concept of Hamming weight is very important in many fields, including information theory, coding theory, and other fields related to binary data processing. Assuming there is a binary string C with length n, the Hamming weight W(C) of the string can be calculated using the following formula:

[0128]

[0129] Among them, c i It is the value of string C at position i; only when c i This item will only be included in the sum if its value is equal to 1.

[0130] The application of Hamming weight in feature extraction is mainly based on its ability to quantify the density and variability of information. By measuring the number of non-zero elements in a data vector, Hamming weight can be a simple and effective way to help distinguish and identify different patterns or categories in a dataset. In anomaly detection tasks, a feature vector that is very different from most data points may have a significantly different Hamming weight. By analyzing the distribution of Hamming weights, data points that are anomalous or do not conform to the overall distribution pattern can be identified.

[0131] Define the arbitration field of the current data frame as id i The arbitration field of the data frame adjacent to the current data frame is id. i-1 Then the Hamming distance in the arbitration field of adjacent data frames is:

[0132]

[0133] Among them, id i [j]∈{0,1} represents the arbitration field id. i The value of the j-th bit in an 11-bit binary sequence; Indicates a bitwise XOR operation;

[0134] In this embodiment, the Hamming distance is a metric that measures the difference between two strings of equal length. It describes the number of different characters at corresponding positions in two strings of the same length. Assuming two strings A and B of equal length, with a length of n, the Hamming distance D(A,B) can be calculated using the following formula:

[0135]

[0136] Among them, a i b represents the feature value of data point A at position i; i This represents the feature value of data point B at position i; when a i With b i When they are not equal, it indicates that there is a difference between the two data points at that position, therefore (a i ≠b i The value of ) is counted as 1, otherwise it is 0;

[0137] Hamming distance is mainly used as a feature extraction tool in the field of anomaly detection. In anomaly detection, using Hamming distance as a feature extraction tool can help identify irregular and anomalous patterns in a dataset.

[0138] Calculate the frequency of the arbitration field in each CAN data frame within the calculation window:

[0139]

[0140] Where, N i This indicates the number of arbitration fields in the window that are identical to the arbitration field of the current CAN data frame; n represents the window size.

[0141] Step 1.3.3: Feature Extraction of Data Fields

[0142] The data field consists of several bytes, the number of which is determined by the DLC; the binary form of the data field defining the CAN data frame is as follows:

[0143] data={d1,d2,...,d 8·DLC}

[0144] d i ∈{0,1}

[0145] The Hamming weight of the data field in the CAN data frame is calculated as follows:

[0146] Define the data field of the current CAN data frame as data. i The data field of the previous CAN data frame in the window is data. i-1 Then adjacent The Hamming distance of the data fields in the data frame is:

[0147]

[0148] Among them, data i [j]∈{0,1} represents the data field data i The value of the j-th bit in the 64-bit binary sequence; if the length of the data field is less than 64 bits, missing bits need to be padded with 0 before calculation;

[0149] Find the nearest data frame in the sequence that has the same arbitration field as the current CAN data frame. If such a data frame is found, calculate the Hamming distance D between the data fields of the current data frame and that data frame. s That is, the Hamming distance between the data fields of the most recent CAN data frames with the same arbitration field is:

[0150]

[0151] Among them, datai This indicates the data field of the current CAN data frame; data s This indicates the data field of the data frame that is closest to the current CAN data frame and has the same data field. If there is no CAN data frame with the same arbitration field, the corresponding distance feature will be set to 0 to avoid missing values.

[0152] Calculate the information entropy of the data fields in a CAN data frame:

[0153]

[0154] Where, p i Represents data frame i The probability of 0 or 1 appearing in the middle;

[0155] In this embodiment, information entropy is one of the metrics for measuring the randomness or uncertainty of information. The higher the entropy, the greater the uncertainty contained in the information; the lower the entropy, the smaller the uncertainty of the information.

[0156] The mathematical definition of information entropy is as follows: Suppose an information source can emit a series of possible messages, where the probability of the i-th message appearing is p(i), then the entropy H of the information source can be expressed by the following formula:

[0157]

[0158] The unit of entropy is bits; this formula expresses the negative log-weighted average of the probabilities of an event, providing a measure of the uncertainty of a random variable; when all events in a system have equal probabilities of occurrence, the information entropy of the system reaches its maximum value, reflecting the highest uncertainty.

[0159] The application of information entropy in anomaly detection mainly relies on its ability to measure information uncertainty, providing an effective means to identify abnormal or unusual patterns in data; in the process of anomaly detection of time series data, abrupt changes in data behavior can be detected by analyzing the entropy changes of data within a time window.

[0160] Step 1.3.4: Based on the time difference Δt between adjacent CAN data frames in Step 1.3.1 i In step 1.3.2, the Hamming weight hw in the arbitration field of the CAN data frame id Hamming distance in the arbitration field of adjacent CAN data frames Frequency of occurrence of the arbitration field in CAN data frames In step 1.3.3, the Hamming weight hw in the data field of the CAN data frame data Hamming distance D between the data fields of adjacent CAN data frames iHamming distance D of the data fields in the most recent CAN data frame with the same arbitration field s Entropy, the information entropy of the data fields in the CAN data frame, is used to construct a multi-dimensional raw feature dataset of the CAN bus.

[0161] As shown in Table 1, this embodiment extracts all features based on the characteristics of the CAN data frame window sequence and constructs a feature vector sequence consisting of 8 dimensions. This feature sequence is input into the anomaly detection model in units of windows for model training and anomaly detection task execution.

[0162] Table 1 Feature Vector Sequence List

[0163]

[0164] Step 1.4: Label the original multi-dimensional feature dataset from Step 1.3 with the corresponding vehicle models.

[0165] Step 2: The cloud server inputs the multi-dimensional raw feature data labeled in Step 1 into the anomaly detection model for training through a domain adversarial adaptive network. In this embodiment, the multi-dimensional raw feature data is input into the anomaly detection model for training through a domain adversarial adaptive network, which solves the problem of low universality of the anomaly detection model across different vehicle models, obtains cross-vehicle anomaly detection capability, and has the characteristics of enhancing the model's generalization ability and adaptability.

[0166] In this embodiment, the Domain-Adversarial Training of Neural Networks (DANN) is an instantiation of the Domain-Adversarial Training of Neural Networks algorithm under a specific network structure; the two are essentially the same. DANN is a technique used in deep learning and transfer learning to solve the domain adaptation problem. Its goal is to train a model that performs well in the transfer from the source domain (the dataset used during training) to the target domain (the dataset used in the actual application), even if the data in the target domain is unseen during training. The specific working principle of this algorithm is given below:

[0167] Given an input space X = {x1, x2, ..., x...} n Given a binary label set Y = {0, 1} and a binary classifier η: X → Y; and a source domain. and target domain Feature extraction neural network G f It can be defined as:

[0168] G f (x;W,b)=sigmoid(Wx+b)

[0169] Where (W,b) represents the network weights and biases; x∈D s ;

[0170] Tag classifier network G C It can be represented as:

[0171] G C (G f (x); V,c)=sigmoid(VG f (x)+c)

[0172] Where (V,c) represents the network parameters;

[0173] Domain Discriminator Network G D This can be expressed as:

[0174] G D (G f (x); u,z)=sigmoid(u T G f (x)+z)

[0175] Where (u,z) represents the network parameters;

[0176] More specifically, for a given sample label pair (x, y), x∈X, y∈Y, the loss L of the domain discriminator is... D The definition is as follows:

[0177]

[0178] and

[0179]

[0180] Where, γ i Indicates sample x i The field label; if x i If it comes from the source domain, then γ i =1, otherwise γ i =0;

[0181] Among them, the label classifier loss L y Defined as:

[0182]

[0183] The optimization function of a domain-adversarial neural network can be written as:

[0184]

[0185] Where, n S Indicates the number of samples from the source domain; n T Indicates the number of samples from the target domain;

[0186] like Figure 3 As shown, when using the domain adversarial adaptive algorithm for training, the two simultaneous processes of label classifier training and domain discriminator training play a crucial role.

[0187] like Figure 4 As shown, the training of the anomaly detection model in this embodiment uses a Domain Adversarial Neural Network (DANN) as the basic network framework. The encoder in the autoencoder network is used as the feature extractor, while the decoder reconstructs the extracted features. Then, a fully connected layer neural network is used as the domain discriminator in the adversarial training.

[0188] Furthermore, the anomaly detection model in step 2 specifically includes:

[0189] Feature Calculator: Calculates the raw feature data of the vehicle CAN bus dataset, providing input for the feature extractor;

[0190] Feature extractor: maps raw feature data to a latent feature space to generate latent feature representations;

[0191] Decoder: Reconstructs the latent feature representation output by the feature extractor into the original feature data;

[0192] Domain discriminator: Symmetric to the feature extractor, used to reconstruct the latent feature representation output by the feature extractor into the original feature data;

[0193] Training layer: Normal CAN bus data from different vehicle models are used to generate raw feature data through a feature calculator. Then, the feature extractor, decoder, and domain discriminator are combined to jointly optimize and achieve the following objectives:

[0194] Minimize the reconstruction loss of the decoder to improve the reconstruction capability of the feature extractor;

[0195] Maximize the classification loss of the domain discriminator to enhance the cross-domain capability of the feature extractor, thereby extracting domain-invariant feature representations;

[0196] Based on the reconstruction loss distribution of normal data, a detection threshold for reconstruction error is generated;

[0197] Anomaly Detection Layer: After generating raw feature data from the unknown CAN bus data of the vehicle using a feature calculator, the reconstruction error is calculated based on the feature extractor and decoder trained in the training layer. If the error exceeds the generated detection threshold, it is detected as an anomaly.

[0198] Output layer: Outputs the final anomaly detection results.

[0199] Furthermore, step 2 specifically includes:

[0200] Step 2.1: Input the labeled multi-dimensional raw feature data from Step 1 into the feature extractor;

[0201] Step 2.2: The feature extractor passes the annotated multi-dimensional raw feature data from Step 2.1 through hidden states to a fully connected layer. The output of the fully connected layer is further mapped to the decoder. In this embodiment, the feature extractor is used to learn the common feature intervals between different vehicle model data, thereby extracting features suitable for cross-domain anomaly detection. The input sample sets of the two domains can be represented by X. S and X T The superscript S and T represent the source and target domains, respectively; for the input space and output space Feature extractors aim to find a neural network (φ(·:w) f ):χ→f), which maps the input samples to the m-dimensional feature space f; where w f =(w1,w2,...,w L ), w L These are the network weights of the Lth hidden layer; the encoder output is mapped to a fully connected layer, and then input to the decoder and the domain discriminator, respectively.

[0202] Step 2.3: The decoder reconstructs the output of the fully connected layer in Step 2.2 into multi-dimensional original feature data, and generates a reconstruction loss for the multi-dimensional original feature data from the source and target domains; in the decoder stage of this embodiment, the embedding representation is reconstructed back to the original input record; the decoder's loss function L c By calculating the input x i With reconstruction output The difference between them is used to draw conclusions;

[0203] Furthermore, the reconstruction loss in step 2.3 specifically includes:

[0204]

[0205] Among them, L c Represents the reconstruction loss; N represents the number of samples; x i This represents the original feature input data for the i-th vehicle; This represents the i-th reconstructed data generated by the decoder;

[0206] Reconstruction loss is the input x i and its reconstruction The square of the Euclidean distance between the input and output is used to evaluate the performance of the decoder in reconstructing the input data; this loss function guides the decoder to learn to generate a reconstruction that is as close as possible to the original input, thereby reducing information loss.

[0207] Reconstruction loss is the degree of deviation of the original data from the trained normal behavior; a threshold is defined to identify possible anomalies; if the reconstruction loss is higher than the defined threshold, the data record is detected as an anomaly; therefore, given a data record x... i The formula for detecting an abnormality (1) or normality (0) is as follows:

[0208] L c,i =||x i -x′ i || 2

[0209]

[0210] Among them, L c,i y represents the reconstruction loss of the i-th data record; th represents the threshold; y represents the predicted label; the threshold is selected based on the 95th percentile reconstruction loss of the training data; the threshold should capture the baseline data boundary, capture fluctuations in normal behavior, and make abnormal data exceed the boundary, thus making them easy to detect.

[0211] Step 2.4: The domain discriminator determines the vehicle type based on the output of the fully connected layer in Step 2.2, and optimizes the classification loss of the domain discriminator by backpropagation;

[0212] In this embodiment, the domain discriminator performs supervised domain classification on the input data and uses labels to determine the vehicle model corresponding to the input data. During the backpropagation learning process, the classification loss of the domain discriminator is updated to a negative value before being passed to the previous layer. Through this process, the feature extractor can learn general features that prevent domain differentiation. In addition, since this training is performed simultaneously with the decoder training, the features used not only need to be able to effectively distinguish the categories required for reconstruction, but also need to remain neutral to the input domain.

[0213] Furthermore, the classification loss of the domain discriminator in step 2.4 specifically includes:

[0214]

[0215] Among them, L d The loss function of the domain discriminator; y i Indicates the true label of the sample; c i The domain discriminant's judgment result on the input data; N represents the number of samples;

[0216] The autoencoder algorithm is also reflected in the entire training process of the anomaly detection model. The autoencoder algorithm is an unsupervised learning algorithm that learns an efficient representation of data through a neural network. The algorithm consists of two parts: an encoder and a decoder. In this embodiment, the feature extractor is based on the encoder in the autoencoder network. The encoder is responsible for transforming the input data into a lower-dimensional intermediate representation, while the decoder is responsible for restoring the original data from this intermediate representation. The training objective of the autoencoder is to minimize the difference between the input data and the reconstructed data, i.e., the reconstruction error. In anomaly detection scenarios, anomalous data is in the minority compared to normal data. If the difference between the output reconstructed by the autoencoder and the original input exceeds a certain threshold, the original data is considered to be anomalous.

[0217] Figure 5 This is the basic architecture of an autoencoder. The architecture and number of hidden layers of an autoencoder are determined by the application domain and usage scenario. Theoretically, given an input x, an autoencoder is trained to minimize the reconstruction loss. The relevant formulas are as follows:

[0218]

[0219] Ψ:F→x',

[0220]

[0221] in, Ψ represents the encoding function; Ψ represents the decoding function.

[0222] Typically, the reconstruction loss of input x is represented by the difference between x and x', x' = g(f(x)), where f(x) is the encoding function that constructs the encoded vector of x, and g(x) is the decoding function that reconstructs x' to its initial value. The reconstruction loss is defined by a function representing the difference between the input x and the reconstructed input x'. Mean squared error (MSE) and mean absolute error (MAE) are commonly used functions for calculating the reconstruction loss, respectively:

[0223]

[0224]

[0225] Autoencoders have efficient data compression (encoding) and decompression (decoding) capabilities, and their unsupervised training process can adapt to processing raw network traffic data (unlabeled data), effectively detecting unknown network attacks;

[0226] Step 2.5: While minimizing the reconstruction loss of the decoder in Step 2.3, maximize the classification loss of the domain discriminator in Step 2.4, so that the feature extractor learns the domain-invariant features of different vehicle models, thereby completing the training of the anomaly detection model;

[0227] The final loss function for the entire network is:

[0228] L t =L c +λ d ·L d

[0229] Where, λ d This represents a weighting coefficient used to balance the contributions of the two loss functions;

[0230] The optimization of the training process involves two loss functions, where L c The task is to reconstruct the loss (used for the main task), while L d The domain discriminator classification loss is used; the reconstruction loss and the domain discriminator classification loss compete with each other in an adversarial manner. When the optimization process converges, the reconstruction loss on the source domain is minimized, while the domain discriminator classification loss is maximized. This maximization is achieved by changing the sign of the gradient from the domain classification layer to the feature representation layer. Therefore, the update of the feature representation parameters is opposite to the gradient direction. The stochastic gradient descent method is used to try to maintain the consistency of cross-domain features, ensuring that the knowledge learned from the source domain is still valid for the target domain without performance loss.

[0231] Step 3: The cloud server distributes the anomaly detection model trained in Step 2 to the roadside unit via edge computing;

[0232] Furthermore, step 3 specifically includes:

[0233] Step 3.1: The cloud server packages the trained anomaly detection model into a format suitable for roadside unit deployment, preparing it for subsequent distribution and deployment;

[0234] Step 3.2: The cloud server selects appropriate roadside units to distribute the anomaly detection model based on the computing power, network status, and task requirements of the edge nodes.

[0235] Furthermore, step 3.2 specifically includes:

[0236] Step 3.2.1: Evaluation of edge node computing power and network status

[0237] The cloud server collects and records in real time the CPU performance, memory resources, GPU resources, bandwidth, latency, packet loss rate, and the number of tasks and resource utilization of the roadside units;

[0238] Step 3.2.2: Task Requirements Analysis and Node Matching

[0239] Based on the complexity, inference time constraints, and network latency tolerance of the anomaly detection model to be deployed, the cloud server establishes an evaluation model to match the adaptability of roadside units with task requirements, calculates the adaptability score of each node, and determines the priority ranking; the evaluation model is specifically as follows:

[0240] Score = w1 × S 复杂度 +w2×S 推理时间 +w3×S 网络延迟

[0241] Among them, S 复杂度 The parameters, computational cost, and memory size of the anomaly detection model; S 推理时间 S is the inference time; 网络延迟 The network latency is represented by w1, w2, and w3, which are weighting coefficients, and w1 + w2 + w3 = 1.

[0242] Step 3.2.3: Optimal Node Selection and Model Deployment

[0243] Based on the adaptation ranking results, the cloud server selects the highest-ranked roadside unit as the model deployment target and pushes the anomaly detection model to the corresponding roadside unit.

[0244] In this embodiment, edge computing, as a novel technology that integrates mobile access networks and Internet services, pushes computing power down to edge nodes, which are closer to the user end than the core cloud, thus saving bandwidth and reducing the latency of user data processing.

[0245] Step 4: The vehicle extracts multi-dimensional raw features of unknown CAN bus data in real time and uploads them to the roadside unit in Step 3 for online anomaly detection;

[0246] like Figure 6 As shown, the roadside unit receives multi-dimensional raw features of unknown CAN bus data extracted from the vehicle and uses the trained anomaly detection model mounted on the roadside unit to perform real-time detection, and finally outputs the anomaly detection results.

[0247] Figure 7 This is a specific implementation example of the CAN bus anomaly detection of the present invention. The process is divided into an offline model training stage and an online detection stage:

[0248] In the offline training phase of the model: First, the normal CAN bus datasets of vehicle models 1 and 2 are input into the cloud server, and the CAN data frames in the CAN bus dataset are sorted according to time series. Then, the cloud server extracts CAN data frames based on the sliding window idea, extracts features from the time dimension, arbitration field, and data field of the CAN data frames, and inputs them into the anomaly detection model. The feature extractor of the anomaly detection model maps the multi-dimensional original features to a low-dimensional feature space (Embedding), and the domain discriminator classifies the low-dimensional feature space and distinguishes the vehicle models. At the same time, the decoder attempts to reconstruct the low-dimensional feature space into the original features, and attempts to generate a low-dimensional feature space that can confuse the domain discriminator through adversarial training of the feature extractor, so as to achieve domain adaptation.

[0249] Online detection phase: Finally, the trained anomaly detection model is sent to the roadside unit, which performs online detection on the multi-dimensional raw features of the unknown CAN bus data extracted from the vehicle to be detected.

[0250] Figure 8 This is an architecture diagram of the cloud-side-vehicle collaborative anomaly detection method of the present invention. Based on the different functions of the members, the architecture diagram can be divided into a cloud server, a roadside unit, and a vehicle terminal. The tasks of the cloud server, roadside unit, and vehicle in the anomaly detection process are as follows:

[0251] Cloud server: responsible for offline training of anomaly detection model, integrating normal CAN bus data from different vehicle models, extracting unified features across vehicle models through adversarial domain adaptive technology, and completing model training optimization; the trained model will be sent to roadside units (RSU) to support subsequent real-time detection;

[0252] Roadside unit: Deploys a cloud-trained anomaly detection model and receives raw feature data uploaded by vehicles; On edge devices, the roadside unit uses the deployed model to perform real-time anomaly detection on the data, and after processing, feeds back the detection results to the vehicle to help the vehicle identify abnormal behavior;

[0253] Vehicle: The vehicle is responsible for extracting multi-dimensional raw features of unknown CAN bus data in real time and uploading the extracted feature data to nearby roadside units for processing; in addition, the vehicle receives the detection results sent by the roadside units to achieve rapid response to abnormal behavior.

[0254] The application effects of this invention will be described in detail below with reference to simulation experiments.

[0255] The experimental environment is shown in Table 2. The dataset used is the public dataset Survival Analysis Dataset for automobile IDS from HACKING AND COUNTERMEASURE RESEARCHLAB, which contains normal and abnormal driving data from three different types of vehicles: Soul, Spark, and Sonata. The abnormal data contains three types of attacks: Flooding, Fuzzing, and Malfunction. A series of experiments were conducted to verify the effectiveness of the present invention in cross-vehicle anomaly detection.

[0256] Table 2 Experimental Environment

[0257] operating system Windows 11 Memory 2*16G Graphics card (video memory) GTX3050Ti (12G) Simulation environment Python 3.8, PyTorch 2.1.2

[0258] Evaluation of the effectiveness of the plan

[0259] Figure 9 This is a graph used in the experiment to verify the relationship between the size of the sliding window for the CAN data frame sequence and the accuracy. The vertical axis represents accuracy, and the horizontal axis represents the window size. Figure 9 It is known that both excessively large and excessively small sliding windows will affect the accuracy of model detection. Based on experimental results, the detection model has the best attack detection effect on CAN data frames when the window size is 80. Therefore, this scheme will use a window size of 80 for the experiment.

[0260] By using data from different vehicle models, this solution was applied to perform anomaly detection, thereby verifying the rationality of the adversarial domain adaptive anomaly detection scheme proposed in this invention.

[0261] Table 3 shows the anomaly detection results of the anomaly detection model obtained without adversarial domain adaptive training on the Spark normal dataset, and its detection results on the cross-vehicle anomaly dataset. The anomaly datasets for Spark, Soul, and Sonata models include flooding attacks, fuzzy attacks, and imitation attacks. The results show that the cross-domain detection accuracy of Soul and Sonata models is reduced to varying degrees.

[0262] Table 3 Anomaly detection results of AE model

[0263] Model Accuracy Precision Recall F1socre Spark 0.9658 0.9296 0.9992 0.9631 Sonata 0.8265 0.7263 0.9988 0.8410 Soul 0.9281 0.9996 0.8655 0.9278

[0264] Table 4 shows that when the anomaly detection model with added adversarial domain adaptation performs anomaly detection across vehicle models, the detection accuracy for Sonata anomaly data increases from 0.8265 to 0.9486, while the detection accuracy for Soul anomaly data increases from 0.9281 to 0.9543, which is in line with the experimental expectations.

[0265] Table 4 Anomaly detection results of the AE model under adversarial domain adaptation

[0266] Model Accuracy Precision Recall F1socre Spark 0.9871 0.9878 0.9868 0.9873 Sonata 0.9486 0.9048 0.9566 0.8267 Soul 0.9543 0.9462 0.9428 0.9264

[0267] To better illustrate the differences in data distribution among different vehicle models, this experiment uses t-distributed random neighbor embedding (t-SNE) to visualize the data characteristics of normal driving on the CAN bus of Soul and Sonata vehicles; such as Figure 10 As shown, most red and green dots are distributed in different locations, which is due to the difference in data distribution between the two vehicle models; therefore, an anomaly detection model trained on one vehicle model cannot be applied to other vehicle models; for example... Figure 11 As shown, after the adversarial domain adaptive feature mapping proposed in this invention, most of the red and green dots are distributed in the same position, which shows that the anomaly detection model trained by the mapped feature data can be applied to different vehicle models.

[0268] Table 5 shows the detection performance of the anomaly detection model trained in this invention under different attacks. It has high detection accuracy for Flooding and Fuzzy attacks, reaching 0.9916 and 0.9884 respectively. The accuracy for the more complex Malfunction attack also reaches 0.9412, which shows that this invention has good detection performance for different types of attacks.

[0269] Table 5. Detection performance of the anomaly detection model trained in this invention under different attacks.

[0270] Attack type Accuracy Precision Recall F1Socre Flooding 0.9916 0.9896 0.9986 0.9834 Fuzzy 0.9884 0.9899 0.9855 0.9863 Malfunction 0.9412 0.9657 0.8943 0.9286

[0271] Figure 12 The paper presents a comparison of the attack detection performance of three methods on different vehicle model datasets. The results show that the method proposed in this invention outperforms the other two methods in attack detection across different vehicle model datasets. In particular, when performing cross-vehicle model detection, after domain adaptive training, the method proposed in this invention significantly outperforms the existing autoencoder (AE) and CANet schemes in detection performance on Soul and Spark vehicle models. This result fully verifies the effectiveness of the method proposed in this invention.

[0272] Evaluation of the effectiveness of the scheme

[0273] Table 6. Anomaly Detection Model Size and Detection Time

[0274] storage space Detection time 30.1MB 0.11 milliseconds

[0275] Table 6 shows that the storage space of the anomaly detection model trained by this invention is 30.1MB, and the detection time for each CAN bus data is 0.11 milliseconds. It can be seen that the solution can meet the communication requirements of the in-vehicle CAN bus in terms of computational efficiency. At the same time, since the model is deployed in the road test unit, its storage space also fully meets the requirements of anomaly detection. This makes the solution of this invention well adaptable to the real-time and resource-constrained requirements of the Internet of Vehicles environment, providing an efficient and feasible solution for CAN bus security protection.

[0276] The above embodiments are merely detailed descriptions of the present invention, but the present invention is not limited to the above embodiments. Any modifications, substitutions, and changes made to the present invention within the spirit and scope of the claims are within the scope of protection of the present invention.

Claims

1. A method for detecting abnormal traffic for a CAN bus, characterized in that: The method comprises the following steps: Step 1: the cloud server performs multi-dimensional original feature extraction on the normal CAN bus data set of different vehicle models, and labels the extracted multi-dimensional original features; The multi-dimensional original features include the time difference of adjacent CAN data frames, the Hamming weight of the arbitration field of the CAN data frame, the Hamming distance of the arbitration field of adjacent CAN data frames, the frequency of the appearance of the arbitration field of the CAN data frame, the Hamming weight of the data field of the CAN data frame, the Hamming distance of the data field of adjacent CAN data frames, the Hamming distance of the data field of the nearest identical arbitration field CAN data frame, and the information entropy of the data field of the CAN data frame; Step 2: the cloud server inputs the labeled multi-dimensional original feature data in step 1 into an anomaly detection model through a domain adversarial adaptive network for training; Step 3: the cloud server distributes the trained anomaly detection model in step 2 to the roadside unit through edge computing; Step 4: the vehicle extracts the multi-dimensional original features of unknown CAN bus data in real time and uploads them to the roadside unit in step 3 for online anomaly detection.

2. The method for detecting abnormal traffic for CAN bus according to claim 1, characterized in that: The step 1 specifically comprises: Step 1.1: the cloud server collects and integrates the normal CAN bus data set of different vehicle models; Step 1.2: the cloud server sorts the data frames in the normal CAN data set in step 1.1 according to the time sequence and extracts the CAN data frames in the sliding window; Step 1.3: in the sliding window of step 1.2, the features are extracted from the time dimension, the arbitration field and the data field of the CAN data frame by using the Hamming distance, the Hamming weight and the cosine similarity, respectively, to obtain the original multi-dimensional feature data set of the sliding window; Step 1.4: the original multi-dimensional feature data set in step 1.3 is labeled according to the corresponding vehicle model.

3. The method for detecting abnormal traffic for CAN bus according to claim 2, characterized in that: The step 1.2 specifically comprises: The size of the sliding window is determined as n, and CAN1 is taken as the first CAN data frame within the sliding window, and CAN n As the end frame, the sequence of CAN data frames is: CAN series = {CAN1, CAN2..., CAN n} The timestamp, arbitration field and data field in each CAN data frame in the window are extracted, and the hexadecimal in the arbitration field and data field is converted into binary.

4. The method for detecting abnormal traffic for CAN bus according to claim 2, characterized in that: The step 1.3 specifically comprises: Step 1.3.1: time dimension feature extraction Define t i Calculate the timestamp t for each CAN data frame within the window. i Timestamp t of the previous CAN data frame i-1 The interval, i.e., the time difference between adjacent CAN data frames, is: Δt i = t i - t i-1 Step 1.3.2: arbitration field feature extraction The arbitration field of each CAN data frame in the window is defined as id, which consists of 11 bits of binary: id={d1,d2,...,d 11} d i ∈{0,1} The Hamming weight of the arbitration field of the CAN data frame is calculated as: The arbitration field of the current CAN data frame is defined as id i The arbitration field of the data frame adjacent to the current CAN data frame is id i-1 The Hamming distance of the arbitration field of the adjacent CAN data frame is: where id i [j]∈{0,1} represents the jth bit value of the 11-bit binary sequence of the arbitration field id i represents a bitwise XOR operation;​ The frequency of the appearance of the arbitration field of each CAN data frame in the window is calculated as: where N i represents the number of data frames in the window that have the same arbitration field as the current CAN data frame; n represents the window size; Step 1.3.3: data field feature extraction The data field is composed of a number of bytes, the number of which is determined by DLC; the binary form of the data field of the CAN data frame is defined as follows: data = {d1, d2,..., d 8·DLC} d i ∈{0,1} The Hamming weight of the data field of the CAN data frame is calculated as: data i data i-1 the hamming distance of the data fields of adjacent CAN data frames is wherein data i represents a 64-bit binary sequence of the data field data i ; if the data field is less than 64 bits in length, the missing bits are padded with 0s before the calculation. finding a data frame in the sequence which has the same arbitration field as the current CAN data frame and is closest to the current data frame, if the data frame is found, calculating the Hamming distance D between the data field of the current data frame and the data field of the data frame s i.e. the Hamming distance of the data field of the closest same-arbitration-field CAN data frame is: wherein, data i represents the data field of the current CAN data frame; data s represents the data field of the data frame that is closest to the current CAN data frame and has the same data field; if there is no CAN data frame with the same arbitration field, to avoid missing values, the corresponding distance feature is set to 0; The information entropy of the data field of the CAN data frame is calculated as: where p i represents the probability of 0 or 1 appearing in data frame data i frame data Step 1.3.4: Time difference At between adjacent CAN data frames based on Step 1.3.1 i Hamming weight hw of the arbitration field of the CAN data frames in Step 1.3.2 id Hamming distance of the arbitration field of adjacent CAN data frames Frequency of the arbitration field of the CAN data frames Hamming weight hw of the data field of the CAN data frames in Step 1.3.3 data Hamming distance D of the data field of adjacent CAN data frames i Hamming distance D of the data field of the nearest identical arbitration field CAN data frames s Information entropy Entropy of the data field of the CAN data frames Building a multi-dimensional raw feature dataset of the CAN bus 5. The method for detecting abnormal traffic for CAN bus according to claim 1, characterized in that: The anomaly detection model in step 2 specifically comprises: Feature calculator: calculates the original feature data of the vehicle CAN bus data set and provides input for the feature extractor; Feature extractor: maps the original feature data to a latent feature space to generate a latent feature representation; Decoder: reconstructs the latent feature representation output by the feature extractor into original feature data; Domain discriminator: symmetrical to the feature extractor, used to reconstruct the latent feature representation output by the feature extractor into the original feature data; Training layer: generates original feature data from CAN bus normal data of different vehicle models through the feature calculator, and realizes the following goals by combining the feature extractor, decoder and domain discriminator for joint optimization: Minimize the reconstruction loss of the decoder to improve the reconstruction ability of the feature extractor; Maximize the classification loss of the domain discriminator to enhance the cross-domain ability of the feature extractor, thereby extracting domain-invariant feature representation; Based on the reconstruction loss distribution of normal data, generate a detection threshold for reconstruction error; Abnormality detection layer: after the unknown CAN bus data of the vehicle is processed by the feature calculator to generate original feature data, the feature extractor and decoder trained by the training layer are used to calculate the reconstruction error of the original feature data; if the error exceeds the generated detection threshold, it is detected as an abnormal state; Output layer: outputs the final abnormality detection result.

6. The method for detecting abnormal traffic for CAN bus according to claim 1 or 5, characterized in that: The step 2 specifically comprises: Step 2.1: input the multi-dimensional original feature data labeled in step 1 into the feature extractor; Step 2.2: the feature extractor passes the multi-dimensional original feature data labeled in step 2.1 to a fully connected layer through hidden state transmission, and the output of the fully connected layer is further mapped to the decoder; Step 2.3: the decoder reconstructs the output of the fully connected layer in step 2.2 into multi-dimensional original feature data, and generates reconstruction loss for multi-dimensional original feature data from source domain and target domain; Step 2.4: the domain discriminator discriminates vehicle models based on the output of the fully connected layer in step 2.2, and optimizes the classification loss of the domain discriminator by backpropagation; Step 2.5: while minimizing the reconstruction loss of the decoder in step 2.3, maximize the classification loss of the domain discriminator in step 2.4, so that the feature extractor learns domain-invariant features of different vehicle models to complete the training of the abnormality detection model.

7. The method for detecting abnormal traffic for CAN bus according to claim 6, characterized in that: The reconstruction loss in step 2.3 specifically comprises: wherein L c represents the reconstruction loss; N represents the number of samples; x i represents the i-th vehicle original feature input data; represents the i-th reconstruction data generated by the decoder.

8. The method for detecting abnormal traffic for CAN bus according to claim 6, characterized in that: The domain discriminator classification loss in step 2.4 specifically comprises: wherein, L d represents the loss function of the domain discriminator; y i represents the real label of the sample; c i represents the discrimination result of the input data by the domain discriminator; N represents the number of samples.

9. The method for detecting abnormal traffic for CAN bus according to claim 1, characterized in that: The step 3 specifically comprises: Step 3.1: the cloud server packages the trained abnormality detection model into a format suitable for road side unit deployment, preparing for subsequent distribution and deployment; Step 3.2: the cloud server selects appropriate road side units for abnormality detection model distribution according to the computing power, network status and task demand of the edge node.

10. The method for detecting abnormal traffic for CAN bus according to claim 9, characterized in that: The step 3.2 specifically comprises: Step 3.2.1: edge node computing power and network status evaluation The cloud server collects and records the CPU performance, memory resources, GPU resources, bandwidth, delay, packet loss rate of the road side unit, and the number of tasks and resource occupancy rate of the node in real time; Step 3.2.2: task demand analysis and node matching According to the complexity of the abnormality detection model to be distributed, the inference time limit and the network delay tolerance, the cloud server establishes an evaluation model to match the adaptability of the road side unit and the task demand, calculates the adaptability score of each node, and determines the priority ranking; Step 3.2.3: optimal node selection and model distribution The cloud server selects the roadside unit with the highest ranking as a model deployment target according to the ranking result of the adaptation degree, and pushes the anomaly detection model to the corresponding roadside unit.

Images