An in-vehicle network abnormal traffic detection method, system, device and medium

Abstract

The application discloses a kind of vehicle-mounted network abnormal flow detection method, system, equipment and medium, belong to cyberspace security field, method includes: roadside unit is first according to the isolated forest that isolated tree trained according to local CAN bus data set, as benchmark model, each vehicle is according to the latest CAN data frame of oneself calculation isolated tree, mark the feature dimension of isolated tree, and roadside unit uploads the latest isolated tree, then roadside unit selects high-quality isolated tree aggregation and forms high-quality isolated forest, and is issued to each vehicle, when vehicle is outside the communication range of this roadside unit, high-quality isolated forest will be forwarded by other roadside unit, finally each vehicle obtains high-quality isolated forest, and abnormal detection is carried out to CAN data frame, to judge whether CAN data frame is abnormal;System, equipment and medium are used to realize the method;The abnormal detection speed of the application to vehicle-mounted network flow is fast, storage demand is low, data security is high, and simultaneously guarantee that system has higher robustness and detection precision.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security technology, specifically to a method, system, device, and medium for detecting abnormal traffic in vehicle-mounted networks. Background Technology

[0002] In recent years, with the rapid development of the Internet of Vehicles (IoV), modern automobiles have undergone tremendous changes, evolving from simple means of transportation into intelligent, interconnected entities. Externally, vehicles connect and interact with other vehicles, roadside units (RSUs), and service platforms—a process known as Vehicle-to-Everything (V2X). Internally, numerous sensors and electronic control units (ECUs) are connected using specific communication protocols, forming an in-vehicle network. Among these, the Controller Area Network (CAN) bus has become the preferred communication protocol due to its low implementation cost, good scalability, and international standardization. However, the lack of inherent security mechanisms (such as encryption and authentication) in the CAN bus makes it vulnerable to various security threats, including but not limited to spoofing attacks, denial-of-service attacks, and obfuscation attacks. These attacks not only threaten the safety of vehicle owners but also negatively impact other connected vehicle entities.

[0003] One important technology for protecting vehicle network security is to use machine learning to detect anomalies in CAN traffic. This technology learns and identifies CAN traffic patterns to detect abnormal traffic. Given the constantly changing dynamic distribution of CAN bus data in the vehicle network environment, the anomaly detection model needs to be updated in a timely manner to ensure that the model can adapt to new traffic patterns and maintain efficient and accurate monitoring capabilities. However, the existing solutions have the following problems: (1) When using centralized model updates, all data needs to be collected together for retraining, which is computationally expensive and also faces the problem of managing historical data. The collection of new data will involve user privacy issues. (2) When using distributed model updates, the collaborative updating of the model faces a great challenge due to the existence of complex participating entities (such as malicious participants) in the vehicle network. (3) The anomaly detection model has high computational complexity and slow detection speed, making it difficult to meet the real-time response requirements of the vehicle network. (4) The model has large storage requirements and is difficult to deploy in edge nodes with limited hardware resources, such as vehicles.

[0004] Sun et al. published "Anomaly detection for in-vehicle network using CNN-LSTM with attention mechanism" (Sun H, Chen M, Weng J, et al. Anomaly detection for in-vehicle network using CNN-LSTM with attention mechanism[J].IEEE Transactions on Vehicular Technology, 2021, 70(10):10880-10893.), proposing an anomaly detection model for in-vehicle networks based on CNN-LSTM and an attention mechanism, called CLAM. The CLAM model combines a one-dimensional convolutional network and a bidirectional long short-term memory network to extract local features and capture bidirectional dependencies in time series, respectively. The attention mechanism is used to dynamically calculate the importance weights of time steps, enabling the model to focus on key features, thereby improving prediction accuracy. However, this method has the disadvantages of high computational complexity, large model storage requirements, and inability to adaptively update.

[0005] Li et al. published "A Cloud Collaborative-based Intrusion Detection and Prevention System for IVN" (Li S, Cao Y, Liao T, et al. A Cloud Collaborative-based Intrusion Detection and Prevention System for IVN[J]. IEEE Transactions on Cognitive Communications and Networking, 2024.), proposing a cloud-based collaborative intrusion detection system for vehicular networks. This method utilizes a BERT pre-trained model for traffic classification and periodically updates the detection model through a cloud database. However, in the connected vehicle environment, due to the massive traffic volume, long-term storage of historical data will put significant pressure on the server, and the collection of new data involves user privacy issues.

[0006] Huang et al. published "A comprehensive intrusion detection method for the internet of vehicles based on federated learning architecture" (Huang K, Xian R, Xian M, et al. A comprehensive intrusion detection method for the internet of vehicles based on federated learning architecture[J]. Computers & Security, 2024, 147:104067.), proposing a vehicle-to-everything (V2X) intrusion detection method called FED-IoV. This method addresses the issues of limited computing resources and data privacy protection in V2X by employing a federated learning architecture and converting vehicle communication traffic data into images, utilizing a customized lightweight MobileNet-Tiny model for intrusion detection. However, this method does not address the problem of malicious parties uploading malicious models that affect the performance of the global model. Summary of the Invention

[0007] To overcome the shortcomings of existing technologies, this invention aims to provide a method, system, device, and medium for detecting abnormal traffic in vehicular networks. It employs a distributed isolated forest training method, where vehicles only need to train isolated trees based on the latest CAN traffic data and upload these trees to the roadside unit, eliminating the need to upload CAN traffic data externally. This reduces communication overhead and prevents raw data leakage. Secondly, this invention proposes a high-quality isolated tree selection algorithm. By evaluating the isolated trees uploaded by vehicles, the roadside unit aggregates only the latest and highest-quality isolated trees to form an isolated forest, thus achieving adaptive model updates. The updated isolated forest model offers advantages such as high accuracy, low storage requirements, and low computational complexity. Furthermore, this invention designs a malicious isolated tree detection mechanism to optimize the model update process. By discarding malicious isolated trees and marking malicious vehicles, it reduces interference from malicious participants.

[0008] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0009] A method for detecting abnormal traffic in a vehicular network, wherein the vehicular network includes a processing layer, a terminal layer, and a relay layer, and the detection method includes the following steps:

[0010] Step 1: The roadside units in the processing layer form an isolated forest based on the isolated trees trained on the local CAN bus dataset, which serves as a baseline model. Then, the roadside units send a request to the vehicle to collect isolated trees.

[0011] Step 2: Each vehicle in the terminal layer calculates the isolation tree based on its latest CAN data frame, marks the feature dimensions of the isolation tree, and uploads the latest isolation tree to the roadside unit in the processing layer.

[0012] Step 3: The roadside units in the processing layer filter the latest isolated trees uploaded by each vehicle, select high-quality isolated trees to aggregate into a high-quality isolated forest, thereby achieving adaptive model updates.

[0013] Step 4: The roadside unit in the processing layer distributes the high-quality isolated forest to each vehicle. When a vehicle is outside the communication range of the roadside unit, the high-quality isolated forest will be forwarded by the roadside unit in the relay layer.

[0014] Step 5: After each vehicle receives the high-quality isolated forest data from the roadside unit in the processing layer or relay layer, it performs anomaly detection on the CAN data frame to determine whether the CAN data frame is abnormal.

[0015] Step 1 specifically includes:

[0016] First, the isolated forest algorithm is used to process the local CAN bus dataset d={x1,x2,…,x1,x2,…,x2,x3,x4,x5,x6,x7,x8,x9,x1,x2,… ... n The calculation is performed, where each sample has Z feature dimensions, ultimately resulting in an Isolation Forest IF with Z feature dimensions. base As a benchmark model, where IF base It consists of t isolated trees (ITrees), i.e., IF base ={ITree1,ITree2,…,ITree t Then, the roadside unit RSU1 sends a request to the vehicles within the communication range to collect isolated trees, and asks the vehicles to upload the number Z of isolated tree feature dimensions;

[0017] The benchmark model IF base The calculation process is as follows:

[0018] Step 1.1: Construct a single isolated tree (ITree). Assume the local CAN data frame has Z feature dimensions. The isolated tree can be constructed as follows: Let T be the root node of the isolated tree. Constructing the isolated tree requires k samples. This is done by randomly selecting a feature dimension z0 from the Z feature dimensions, and then randomly selecting the value v0 of a sample in feature dimension z0 from the k samples. For all samples in a node, if the value v0 in feature dimension z0... i If the value is less than v0, then the sample will be assigned to the left child node T of T. l Otherwise, it will be assigned to the right child node T of T. rThe left and right child nodes are constructed recursively until one of the following conditions is met: 1. The leaf nodes of the current isolated tree have only one sample or multiple samples with the same value; 2. The current isolated tree reaches a limited height H, which can be obtained by the following formula:

[0019]

[0020] Where k is the number of samples used to construct the isolated tree, H(k) = ln(k) + ξ, and ξ is Euler's constant;

[0021] Step 1.2, repeat step 1.1, until you obtain a set of t isolated trees {ITree1,ITree2,…,ITree}. t} Forming an isolated forest IF base As a benchmark model, namely IF base ={ITree1,Itree2,…,ITree t}

[0022] Step 2 specifically includes:

[0023] The vehicles at the terminal layer undergo distributed isolated tree training, and the vehicles at the terminal layer include normal vehicles c. i and malicious vehicles q i ;

[0024] Normal vehicle c i : Utilizing the vehicle's local real-time CAN data frames i The isolated trees are trained using the isolated forest algorithm to obtain the latest benign isolated trees. And indicate the feature dimensions of the isolated tree. Training multiple benign isolated trees And stored in an isolated tree linked list uploaded by normal vehicles. middle;

[0025] Malicious vehicle q i Malicious isolated trees obtained by using abnormal CAN bus datasets and training with the isolated forest algorithm. And indicate the feature dimensions used by the malicious isolated tree. Training multiple malicious isolated trees And stored in an isolated tree linked list uploaded by malicious vehicles. The abnormal dataset refers to malicious traffic collected from an onboard CAN bus that has been subjected to a network attack.

[0026] After the local isolated tree training is completed, each vehicle uploads its latest isolated tree list to the roadside unit RSU1.

[0027] If edge vehicle e leaves the communication range of roadside unit RSU1, it will upload the local isolated tree list to roadside unit RSU2 in the relay layer within the communication range of the vehicle after training. After receiving the list, roadside unit RSU2 will send the isolated tree list uploaded by edge vehicle e to roadside unit RSU1.

[0028] Step 3 specifically includes:

[0029] Based on the latest isolated tree linked lists uploaded by each vehicle, the roadside unit RSU1 calculates the performance index M of the isolated tree according to its own local CAN bus dataset d. IT Performance metrics M of the benchmark model base And based on the performance metrics obtained from Algorithm 1, malicious isolated trees were selected;

[0030] Algorithm 1: Sets the threshold as the performance index M of the benchmark model. base -Tolerance for malicious actors e Among them, the performance index M of the benchmark model base Including accuracy, recall, precision, or F1 score, when the performance metric M of an isolated tree... IT If the value falls below a set threshold, the isolated tree is determined to be malicious. The performance metric M of the isolated tree is... IT The category and performance index M of the benchmark model base Consistent, 0≤thr e <M base ,thr e The smaller the value, the lower the tolerance. If a vehicle uploads more than 50% of its isolated trees as malicious isolated trees, the vehicle will be marked as a malicious participant. After that, the isolated trees uploaded by the vehicle will be directly discarded, and it will eventually be unable to obtain the latest high-quality isolated forest.

[0031] After discarding malicious isolated trees, the roadside unit RSU1 checks whether the feature dimension of the isolated tree is consistent with the dimension of the baseline model. If they are inconsistent, it will select isolated trees with complementary feature dimensions and merge them.

[0032] After merging isolated trees in the roadside unit RSU1, high-quality isolated trees GIT will be selected based on the local CAN bus dataset d using Algorithm 2 and added to the high-quality isolated forest GIF as the updated model.

[0033] Algorithm 2: First, calculate the accuracy (ACC) of the isolated tree. IT Anomaly score difference (ASC) with isolated trees IT If the accuracy of the isolated tree is ACC IT The accuracy ACC of the benchmark model is greater than that of the benchmark model. base And the outlier score difference (ASG) of isolated treesIT Outlier score difference greater than the baseline model (ASG) base If so, then this isolated tree is determined to be a high-quality isolated tree; the calculation method for the outlier score difference (ASG) is as follows:

[0034] ASG = |μ a -μ n |

[0035] Where, μ a μ is the mean anomaly score of all abnormal data in the CAN bus dataset d on the model. n It is the mean of the abnormal scores on the model for all normal data in the CAN bus dataset d.

[0036] Step 4 specifically includes:

[0037] After obtaining the latest high-quality isolated forest GIF, Roadside Unit RSU1 will distribute the updated model to other Roadside Units RSU2 and normal vehicles within its communication range that assist in forwarding the isolated tree list of edge vehicles. Among them, if an edge vehicle e leaves the communication range of Roadside Unit RSU1 and is regarded as a normal vehicle by Roadside Unit RSU1, the updated model will be distributed by Roadside Unit RSU2 within the communication range of edge vehicle e.

[0038] Step 5 specifically includes:

[0039] After the vehicle obtains the latest high-quality isolated forest GIF, it performs anomaly detection on the CAN data frame to be detected according to Algorithm 3.

[0040] Algorithm 3: Based on the latest isolated forest model, the abnormal score of the CAN data frame to be detected is calculated and compared with the set abnormal score threshold. If the abnormal score is greater than the abnormal score threshold, the CAN data frame to be detected is determined to be abnormal.

[0041] An abnormal traffic detection system for in-vehicle networks includes:

[0042] Baseline model training and isolated tree collection module: The roadside units in the processing layer form an isolated forest based on the isolated trees trained by the local CAN bus dataset, which serves as the baseline model. Then, the roadside units send isolated tree collection requests to the vehicles. Each vehicle in the terminal layer calculates the isolated tree based on its latest CAN data frame, marks the feature dimensions of the isolated tree, and uploads the latest isolated tree to the roadside units in the processing layer.

[0043] Model adaptive update module: The roadside unit in the processing layer filters the latest isolated trees uploaded by each vehicle, selects high-quality isolated trees to aggregate into a high-quality isolated forest, thereby realizing the adaptive update of the model;

[0044] Model synchronization and relay forwarding module: The roadside unit in the processing layer distributes the high-quality isolated forest to each vehicle. When a vehicle is outside the communication range of the roadside unit, the roadside unit in the relay layer will forward the high-quality isolated forest on its behalf.

[0045] Vehicle anomaly detection module: After each vehicle receives the high-quality isolated forest data from the roadside unit in the processing layer or relay layer, it performs anomaly detection on the CAN data frame to determine whether the CAN data frame is abnormal.

[0046] An abnormal traffic detection device for vehicle network, comprising:

[0047] Memory: Used to store the computer program that implements the above-described method for detecting abnormal traffic in a vehicle network;

[0048] Processor: Used to implement the above-described method for detecting abnormal traffic in a vehicle network when executing the computer program.

[0049] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method for detecting abnormal traffic in a vehicle network.

[0050] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0051] 1. This invention uses the isolated forest algorithm to realize anomaly detection of vehicular network traffic, which has the advantages of fast detection speed and low storage requirements.

[0052] 2. This invention designs a distributed isolated forest training method, which enables vehicles to participate collaboratively in model updates. It effectively utilizes real-time CAN traffic data of vehicles, while eliminating the need to upload the original CAN traffic to the outside of the vehicle, thus avoiding the leakage of original data, reducing communication latency, and facilitating real-time model updates.

[0053] 3. This invention designs a high-quality isolated tree screening algorithm, optimizes the aggregation method of isolated trees uploaded by vehicles, and improves the accuracy of the updated anomaly detection model.

[0054] 4. This invention designs a malicious isolated tree detection algorithm, which realizes the discarding of malicious isolated trees and the marking of malicious vehicles, reduces interference from malicious participants, and improves the robustness of the system.

[0055] In summary, this invention offers fast anomaly detection for vehicular network traffic, low storage requirements, and high data security, while also ensuring high robustness and detection accuracy. Attached Figure Description

[0056] Figure 1 This is an architecture diagram of an abnormal traffic detection method for vehicle-mounted networks according to the present invention.

[0057] Figure 2 The following is a flowchart illustrating the adaptive update of the model in this invention.

[0058] Figure 3 This is a schematic diagram of the preliminary steps of constructing an isolated tree according to the present invention.

[0059] Figure 4 This is the decision boundary graph for the isolated forest algorithm of this invention.

[0060] Figure 5 This is a line graph showing the accuracy variations of different high-quality isolated forest versions in the simulation experiment of this invention.

[0061] Figure 6 This is a line graph showing the accuracy changes of high-quality isolated forest under different numbers of maliciously involved vehicles in the simulation experiment of this invention. Detailed Implementation

[0062] The present invention will now be described in detail with reference to the accompanying drawings.

[0063] This invention proposes a method for detecting abnormal traffic in vehicular networks. Therefore, the isolated forest algorithm related to this invention will be described first.

[0064] The Isolation Forest algorithm is a machine learning algorithm used for anomaly detection, and it has wide applications in many fields. An Isolation Forest consists of n isolated trees, which are binary trees where each node either has two child nodes or is a leaf node.

[0065] Figure 3 This demonstrates the initial steps of constructing an isolation tree on two-dimensional feature data. The horizontal axis represents feature 1, and the vertical axis represents feature 2. The first segmentation (red line) randomly selects points along the feature 1 dimension, dividing the data into left and right parts, aiming to gradually isolate outlier data samples. The second segmentation (blue line) again randomly selects points along the feature 1 dimension, further refining the region. The third segmentation (green line) randomly selects points along the feature 2 dimension to divide the data into horizontal regions. By alternating between vertical and horizontal segmentation, the samples are recursively divided into smaller regions. Normal samples (blue dots) are mostly concentrated in the center of the graph, with a small range of feature value variation and a dense distribution. Outlier samples (red dots) are distributed on the periphery, far from the dense area of ​​normal samples, and have high feature value dispersion. As the number of segmentations increases, outlier samples are more easily isolated into smaller regions.

[0066] Specifically, assuming the training samples have Z feature dimensions, an isolation tree can be constructed as follows: Let T be the root node of the isolation tree, and k samples are needed to construct the tree. We randomly select a feature dimension z0 from the Z feature dimensions, and then randomly select the value v0 of a sample in feature dimension z0 from the k samples. For all samples in a node, if the value v0 in feature dimension z0 is... i If the value is less than v0, then the sample will be assigned to the left child node T of T. l Otherwise, it will be assigned to the right child node T of T. r The left and right child nodes are constructed recursively until one of the following conditions is met: 1. The leaf nodes of the current isolated tree have only one sample or multiple samples with the same value; 2. The current isolated tree reaches a limited height H, which can be obtained by the following formula:

[0067]

[0068] Where k is the number of samples used to construct the isolated tree, H(k) = ln(k) + ξ, and ξ is Euler's constant.

[0069] Repeat the above steps until an isolated forest consisting of n isolated trees is constructed.

[0070] For a sample x to be detected, the anomaly score s can be calculated using an isolation forest. s can be obtained from the following formula:

[0071]

[0072] Where c(k) can be obtained from formula (1). h(x) is the number of edges that sample x traverses from the root node of the isolated tree to a certain leaf node, which is called the height of sample x in the isolated tree. E(h(x)) is the average height of sample x in all isolated trees in the isolated forest.

[0073] If the abnormal score s of sample x is greater than the set threshold thr, the sample is determined to be an abnormal sample; otherwise, the sample is determined to be a normal sample.

[0074] Figure 4 The image shows the decision boundary diagram of the Isolation Forest algorithm, marked by a black curve. The location and shape of the decision boundary are determined by the threshold `thr`, which separates normal samples from abnormal samples. Normal samples are distributed in the central region, while abnormal samples are distributed around the outer edge of the decision boundary. Therefore, normal and abnormal samples can be effectively distinguished using the decision boundary in the Isolation Forest.

[0075] All roadside units involved in this invention are trustworthy and possess sufficient normal CAN data frames and a certain amount of abnormal CAN data frames. They have the ability to train anomaly detection models and evaluate model performance. Roadside units can communicate with each other and share data. Malicious vehicles can launch attacks to reduce the accuracy of the global model, and malicious vehicles can conspire and cooperate to launch attacks.

[0076] The symbols used in the proposed solution of this invention and their meanings are shown in Table 1.

[0077] Table 1. Symbol Explanation

[0078]

[0079]

[0080] Based on the different tasks of the members, the solution architecture is divided into a terminal layer, a processing layer, and a relay layer, each responsible for specific tasks and functions. Before training begins, the roadside unit (RSU1) in the processing layer first generates a baseline isolated forest model. Then, each vehicle in the terminal layer trains its local isolated trees and uploads the latest isolated trees to RSU1 for adaptive model updates. When a vehicle leaves the communication range of RSU1, RSU2 in the relay layer assists in forwarding the isolated trees uploaded by that vehicle to RSU1. RSU1 then detects each isolated tree based on its local CAN bus dataset, discarding malicious isolated trees or merging them, and aggregating the high-quality isolated trees to obtain the latest high-quality isolated forest GIF, which is finally distributed to the participating vehicles. See also Figure 1 A method for detecting abnormal traffic in a vehicular network, the vehicular network comprising a processing layer, a terminal layer, and a relay layer, is described below:

[0081] Step 1: The roadside units in the processing layer form an isolated forest based on the isolated trees trained on the local CAN bus dataset, which serves as a baseline model. Then, the roadside units send a request to the vehicle to collect isolated trees.

[0082] Step 2: Each vehicle in the terminal layer calculates the isolation tree based on its latest CAN data frame, marks the feature dimensions of the isolation tree, and uploads the latest isolation tree to the roadside unit in the processing layer.

[0083] Step 3: The roadside units in the processing layer filter the latest isolated trees uploaded by each vehicle, select high-quality isolated trees to aggregate into a high-quality isolated forest, thereby achieving adaptive model updates.

[0084] Step 4: The roadside unit in the processing layer distributes the high-quality isolated forest to each vehicle. When a vehicle is outside the communication range of the roadside unit, the high-quality isolated forest will be forwarded by the roadside unit in the relay layer.

[0085] Step 5: After each vehicle receives the high-quality isolated forest data from the roadside unit in the processing layer or relay layer, it performs anomaly detection on the CAN data frame to determine whether the CAN data frame is abnormal.

[0086] Step 1: Baseline Model Training

[0087] First, the isolated forest algorithm is used to process the local CAN bus dataset d={x1,x2,…,x1,x2,…,x2,x3,x4,x5,x6,x7,x8,x9,x1,x2,… ... n The calculation is performed, where each sample has Z feature dimensions, ultimately resulting in an Isolation Forest IF with Z feature dimensions. base As a benchmark model, where IF base It consists of t isolated trees (ITrees), i.e., IF base ={ITree1,ITree2,…,ITree t Then, the roadside unit RSU1 sends a request to the vehicles within the communication range to collect isolated trees, and asks the vehicles to upload the number Z of isolated tree feature dimensions;

[0088] Benchmark Model IF base The calculation process is as follows:

[0089] Step 1.1: Construct a single isolated tree (ITree). Assume the local CAN data frame has Z feature dimensions. The isolated tree can be constructed as follows: Let T be the root node of the isolated tree. Constructing the isolated tree requires k samples. This is done by randomly selecting a feature dimension z0 from the Z feature dimensions, and then randomly selecting the value v0 of a sample in feature dimension z0 from the k samples. For all samples in a node, if the value v0 in feature dimension z0... i If the value is less than v0, then the sample will be assigned to the left child node T of T. l Otherwise, it will be assigned to the right child node T of T. r The left and right child nodes are constructed recursively until one of the following conditions is met: 1. The leaf nodes of the current isolated tree have only one sample or multiple samples with the same value; 2. The current isolated tree reaches a limited height H, which can be obtained by the following formula:

[0090]

[0091] Where k is the number of samples used to construct the isolated tree, H(k) = ln(k) + ξ, and ξ is Euler's constant;

[0092] Step 1.2, repeat step 1.1, until you obtain a set of t isolated trees {ITree1,ITree2,…,ITree}. t} Forming an isolated forest IF base As a benchmark model, namely IFbase ={ITree1,ITree2,…,ITree t}

[0093] Step 2: Distributed Isolation Tree Training

[0094] The vehicles at the terminal layer undergo distributed isolated tree training, and the vehicles at the terminal layer include normal vehicles c. i and malicious vehicles q i ;

[0095] Normal vehicle c i : Utilizing the vehicle's local real-time CAN data frames i The isolated trees are trained using the isolated forest algorithm to obtain the latest benign isolated trees. And indicate the feature dimensions of the isolated tree. (i.e., the feature dimensions of the data used to train the isolation tree), train multiple benign isolation trees. And stored in an isolated tree linked list uploaded by normal vehicles. middle;

[0096] Malicious vehicle q i : Utilizing the abnormal CAN bus data set h i Malicious isolated trees trained using the isolated forest algorithm And indicate the feature dimensions used by the malicious isolated tree. Training multiple malicious isolated trees And stored in an isolated tree linked list uploaded by malicious vehicles. The abnormal dataset refers to malicious traffic collected from an onboard CAN bus that has been subjected to a network attack.

[0097] After the local isolated tree training is completed, each vehicle uploads its latest isolated tree list to the roadside unit RSU1.

[0098] If edge vehicle e leaves the communication range of roadside unit RSU1, it will upload the local isolated tree list to roadside unit RSU2 in the relay layer within the communication range of the vehicle after training. After receiving the list, roadside unit RSU2 will send the isolated tree list uploaded by edge vehicle e to roadside unit RSU1.

[0099] Step 3: Adaptive Model Update

[0100] See Figure 2 Based on the latest isolated tree linked lists uploaded by each vehicle, the roadside unit RSU1 calculates the performance index M of the isolated tree according to its own local CAN bus dataset s. IT Performance metrics M of the benchmark model base Malicious isolated trees were selected based on the performance metrics obtained from Algorithm 1.

[0101]

[0102]

[0103] This algorithm evaluates the performance of the isolation tree on the local CAN bus dataset d of the roadside unit RSU1 and compares it with the benchmark model. If the performance metric M of this isolation tree IT is lower than the set safety threshold (M base -thr e ), then this isolation tree is determined to be malicious, where M IT and M base are of the same type and can be accuracy, recall, precision, or F1 score. Among them, 0 ≤ thr e < M base , which represents the tolerance for malicious participants. The smaller thr e is, the lower the tolerance, and the easier it is for the isolation tree to be determined as malicious. If the proportion of malicious isolation trees in the isolation trees uploaded by a vehicle exceeds 50%, then the vehicle is marked as a malicious participant. After that, the isolation trees uploaded by this vehicle will be directly discarded, and ultimately it will not be able to obtain the latest high-quality isolation forest. Through this penalty mechanism, the roadside unit does not need to process the isolation trees uploaded by this malicious vehicle, thus reducing the computational overhead and protecting the updated model from the influence of malicious participants, improving the robustness of the model.

[0104] After discarding the malicious isolation trees, the roadside unit RSU1 checks whether the feature dimension of the isolation tree is consistent with that of the benchmark model. If not, it will select the isolation tree with complementary feature dimensions to merge. For example, if the target dimension is Z and the roadside unit RSU1 finds that the dimension of the isolation tree IT1 is Z1 (Z1 < Z), it will look for another isolation tree IT2 with dimension Z2 from the isolation trees uploaded by the vehicle (Z = {Z1, Z2}), and then merge the two isolation trees to obtain the isolation tree HIT with extended dimensions. Since the isolation tree calculates the score by the path length of a sample from the root node to its leaf node to judge the outlier, the shorter the length, the easier it is to be separated (more likely to be an outlier). For the isolation tree HIT with extended dimensions, its detection basis is to take the average of the path lengths of the traffic data in IT1 and IT2. This enables the isolation tree to establish a comprehensive understanding of the data and avoid making decisions relying on secondary or less relevant features.

[0105] After the roadside unit RSU1 merges the isolation trees, it will use Algorithm 2 to screen out the high-quality isolation trees GIT based on the local CAN bus dataset d and add them to the high-quality isolation forest GIF as the updated model.

[0106]

[0107] First, calculate the accuracy (ACC) of the isolated tree. IT Outlier score difference (ASG) with isolated trees IT If the accuracy of the isolated tree is ACC IT The accuracy ACC of the benchmark model is greater than that of the benchmark model. base And the outlier score difference (ASG) of isolated trees IT Outlier score difference greater than the baseline model (ASG) base If so, then this isolated tree is determined to be a high-quality isolated tree.

[0108] The calculation method for the outlier score difference (ASG) is as follows:

[0109] ASG = |μ a -μ n |

[0110] Where, μ a μ is the mean anomaly score of all abnormal data in the local CAN bus dataset d on the model. n It is the average score of abnormal data on the model for all normal data in the local CAN bus dataset d.

[0111] The method for calculating outlier scores in isolated trees follows the definition of the isolated forest algorithm, as shown below:

[0112]

[0113] Where S(x,n,IT) is the anomaly score of the sample x to be detected on the isolated tree obtained by training with n samples. h(x) is the depth at which the sample x falls into a leaf node of the isolated tree.

[0114] The calculation method for c(n) is as follows:

[0115]

[0116] Where H(k) = ln(k) + ξ, and ξ is Euler's constant.

[0117] The value of S(x,n,IT) ranges from 0 to 1. Whether a sample is an anomaly is determined based on the anomaly score in the following two cases:

[0118] 1. The closer the value is to 1, the higher the probability that it is an anomalous sample;

[0119] 2. The closer it is to 0, the higher the probability that it is a normal point.

[0120] It can be seen that the lower the anomaly score of an isolated tree for normal samples and the higher the anomaly score for abnormal samples—that is, the higher the difference in anomaly scores between normal and abnormal samples—the better it can clearly distinguish between these two categories, and thus the higher its detection capability. Therefore, when selecting high-quality isolated tree GITs, the Roadside Unit (RSU1) not only compares the accuracy of the isolated tree GIT with the benchmark model, but also uses the average anomaly score difference between all its normal and abnormal data on that isolated tree to evaluate whether it is superior to the benchmark model. This achieves the goal of selecting high-quality isolated tree GITs across multiple evaluation dimensions.

[0121] Roadside Unit RSU1 will record normal vehicle c i The number of high-quality isolated trees uploaded (GTN) i If GTN i >thr car (Predefined threshold for the number of high-quality isolated trees), then normal vehicle c i These will be considered high-quality vehicles. In subsequent data collection rounds, the Roadside Unit (RSU1) will prioritize the isolated trees uploaded by high-quality vehicles.

[0122] Step 4: Distribute high-quality isolated forests

[0123] After receiving the latest high-quality isolated forest GIF, Roadside Unit RSU1 will distribute the updated model to Roadside Units RSU1 and normal vehicles within its communication range. For edge vehicles e that have left the communication range of Roadside Unit RSU1, if they are considered normal vehicles by Roadside Unit RSU1, the updated model will be distributed on their behalf by Roadside Unit RSU2 within the communication range of edge vehicle e.

[0124] Step 5: Vehicle anomaly detection using high-quality isolated forest.

[0125] After the vehicle obtains the latest high-quality isolated forest, it performs anomaly detection on the CAN data frame to be detected according to Algorithm 3.

[0126]

[0127] This algorithm is based on the latest isolated forest model. It calculates the anomaly score of the CAN data frame to be detected and compares it with a set anomaly score threshold. If the anomaly score is greater than the anomaly score threshold, the CAN data frame to be detected is determined to be abnormal.

[0128] An abnormal traffic detection system for in-vehicle networks includes:

[0129] Baseline model training and isolated tree collection module: The roadside units in the processing layer form an isolated forest based on the isolated trees trained on the local CAN bus dataset, which serves as the baseline model. Then, the roadside units send isolated tree collection requests to the vehicles. Each vehicle in the terminal layer calculates its isolated tree based on its latest CAN data frame, identifies the feature dimensions of the isolated tree, and uploads the latest isolated tree to the roadside units in the processing layer. This is step 1 to 2 for implementing an abnormal traffic detection method for vehicle networks.

[0130] Model adaptive update module: The roadside unit in the processing layer filters the latest isolated trees uploaded by each vehicle, selects high-quality isolated trees to aggregate into a high-quality isolated forest, thereby realizing model adaptive update; used to implement step 3 of a vehicle network abnormal traffic detection method;

[0131] Model synchronization and relay forwarding module: The roadside unit in the processing layer distributes the high-quality isolated forest to each vehicle. When a vehicle is outside the communication range of the roadside unit, the roadside unit in the relay layer will forward the high-quality isolated forest on its behalf; this is used to implement step 4 of a method for detecting abnormal traffic in a vehicle network.

[0132] Vehicle anomaly detection module: After each vehicle receives the high-quality isolated forest from the roadside unit in the processing layer or relay layer, it performs anomaly detection on the CAN data frame to be detected to determine whether the CAN data frame is abnormal; this is used to implement step 5 of a method for detecting abnormal traffic in a vehicle network.

[0133] An abnormal traffic detection device for vehicle network, comprising:

[0134] Memory: Used to store the computer program that implements the above-described method for detecting abnormal traffic in a vehicle network;

[0135] Processor: Used to implement the above-described method for detecting abnormal traffic in a vehicle network when executing the computer program.

[0136] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described method for detecting abnormal traffic in a vehicle network.

[0137] Simulation Experiment

[0138] The following section verifies the effectiveness, robustness, and efficiency of this invention through simulation experiments. The experimental environment is shown in Table 2, and the dataset used is the Car Hacking dataset. The Car Hacking dataset is specifically designed to simulate the communication network inside a vehicle. It records the CAN traffic of a real vehicle through the OBD-II (On-Board Diagnostic Interface) port and injects different types of attack messages into the network traffic to evaluate the network's robustness. The dataset contains normal network traffic samples and various abnormal network traffic samples.

[0139] Table 2 Experimental Environment

[0140] operating system Windows 10 CPU AMDRyzen 55600H Memory 2*16G Graphics card (video memory) GTX3050Ti (12G) Simulation environment Java 20.0.1

[0141] (1) Experimental setup

[0142] Table 3 Training and Test Set Settings

[0143] Dataset types Number of normal samples Number of abnormal samples Training set (roadside units) 10000 10000 Training set (normal vehicles) 30000 0 Training set (malicious vehicles) 0 10000 test set 100000 100000

[0144] This experiment simulates 100 vehicles participating in the training, as shown in Table 3. Each vehicle trains 500 isolated trees based on its local data and uploads them to the roadside unit. The roadside unit then selects 150 high-quality isolated trees to form the final high-quality isolated forest.

[0145] (2) Evaluation of the effectiveness of the plan

[0146] Table 4 shows the effectiveness of this solution in detecting different types of abnormal traffic. These results were obtained without malicious actors. On the overall test set, the solution achieved an F1 score of 0.9942, indicating excellent overall detection performance. For RPMSpoofing attacks, this solution achieved the highest detection performance, with an F1 score of 0.9978, demonstrating a very strong ability to identify this type of attack. For other types of attacks, the solution also showed excellent detection performance, indicating that the proposed method can effectively identify abnormal traffic within the CAN bus.

[0147] Table 4 shows the effectiveness of detecting different abnormal flow rates.

[0148] test set Precision Recall F1 Total test set 0.9917 0.9967 0.9942 Benign & DoS 0.9945 1.0 0.9972 Benign & Fuzzy 0.9778 0.9690 0.9734 Benign & RPMS poofing 0.9956 1.0 0.9978 Benign & Gear Spoofing 0.9943 1.0 0.9971

[0149] Table 5 shows the training methods used for the isolated forest model.

[0150] Different options Accuracy Precision Recall F1 Local training 0.5816 0.6480 0.35724 0.4606 Distributed training & random selection 0.7013 0.6365 0.9387 0.7586 Distributed training & processing 0.9942 0.9917 0.9967 0.9942

[0151] Table 5 shows the performance metrics of different training schemes for the isolated forest model. The first scheme involves roadside units training the isolated forest locally. Due to limited local data, the accuracy of the trained isolated forest model is low, at only 0.5816. The second scheme involves 100 vehicles training isolated trees based on their local data and providing them to the roadside unit. The roadside unit then randomly selects multiple trees from the uploaded isolated trees to form the isolated forest. This method increases the diversity of isolated trees compared to local training, thus improving the accuracy to 0.7013. Scheme three (this scheme) not only uses distributed training but also processes the isolated trees uploaded by vehicles, selecting only high-quality isolated trees to aggregate into an isolated forest, resulting in the highest accuracy of 0.9942.

[0152] To verify that the anomaly detection model proposed in this scheme has the ability to adaptively update, the experiment gradually increased the number of vehicles participating in the model update (from the initial 5 vehicles to 10, 20, 50, 70 and 100 vehicles in turn) and observed the changes in the model's performance after the update. Figure 5 The results demonstrate the accuracy changes of the proposed high-quality isolated forest model after each update. The results show that model updates improve the accuracy of the high-quality isolated forest model. This is because the roadside unit selects the latest and best-performing isolated trees from the isolated trees uploaded by vehicles in real time, aggregates them to construct the CAN bus anomaly detection model, and ensures that the model utilizes the latest dynamic information with each update without requiring retraining.

[0153] (3) Evaluate the robustness of the scheme.

[0154] To verify the robustness of the solution, the experiment was set to keep the number of normal vehicles constant at 100, while introducing different numbers of malicious vehicles to participate in the model update, in order to test the model's performance under different malicious interference conditions. Figure 6 This demonstrates how the accuracy of the high-quality isolated forest changes as the number of malicious vehicles increases during model updates. Because this solution detects and discards malicious isolated trees uploaded by vehicles, the increase in the number of malicious vehicles has little impact on the model's accuracy, maintaining a consistently high level of accuracy.

[0155] (4) Evaluation of the efficiency of the scheme

[0156] Table 5 Model Size and Detection Time

[0157] storage space Detection time 1.144MB 0.053 seconds

[0158] Table 5 shows the final storage space occupied by the anomaly detection model of this scheme, which is only 1.144MB, and it only takes 0.053 seconds to detect 10,000 CAN bus messages. This demonstrates that the scheme performs excellently in terms of computational efficiency and storage requirements, making it a lightweight anomaly detection method. Its low resource consumption and high detection speed make it well-suited to the real-time and resource-constrained requirements of the vehicle networking environment, providing an efficient and feasible solution for the security protection of in-vehicle networks.

Claims

1. A method for detecting abnormal traffic in a vehicular network, wherein the vehicular network comprises a processing layer, a terminal layer, and a relay layer, characterized in that, The detection method includes the following steps: Step 1: The roadside units in the processing layer form an isolated forest based on the isolated trees trained using the local CAN bus dataset, which serves as a baseline model. Then, the roadside units send a request to the vehicle to collect isolated trees. The specific steps are as follows: First, the isolated forest algorithm is used to process the local CAN bus dataset d={x1,x2,…,x1,x2,…,x2,x3,x4,x5,x6,x7,x8,x9,x1,x2,… ... n The calculation is performed, where each sample has Z feature dimensions, ultimately resulting in an Isolation Forest IF with Z feature dimensions. base As a benchmark model, where IF base It consists of t isolated trees (ITrees), i.e., IF base ={ITree1,ITree2,…,ITree t Then, the roadside unit RSU1 sends a request to the vehicles within the communication range to collect isolated trees, and asks the vehicles to upload the number Z of isolated tree feature dimensions; The benchmark model IF base The calculation process is as follows: Step 1.1: Construct a single isolated tree (ITree). Assume the local CAN data frame has Z feature dimensions. The isolated tree can be constructed as follows: Let T be the root node of the isolated tree. Constructing the isolated tree requires k samples. This is done by randomly selecting a feature dimension z0 from the Z feature dimensions, and then randomly selecting the value v0 of a sample in feature dimension z0 from the k samples. For all samples in a node, if the value v0 in feature dimension z0... i If the value is less than v0, then the sample will be assigned to the left child node T of T. l Otherwise, it will be assigned to the right child node T of T. r The left and right child nodes are constructed recursively until one of the following conditions is met:

1. The leaf nodes of the current isolated tree have only one sample or multiple samples with the same value; 2. The current isolated tree reaches a limited height H, which can be obtained by the following formula: Where k is the number of samples used to construct the isolated tree, H(k) = ln(k) + ξ, and ξ is Euler's constant; Step 1.2, repeat step 1.1, until you obtain a set of t isolated trees {ITree1,ITree2,…,ITree}. t } Forming an isolated forest IF base As a benchmark model, namely IF base ={ITree1,ITree2,…,Itree t }; Step 2: Each vehicle in the terminal layer calculates the isolation tree based on its latest CAN data frame, marks the feature dimensions of the isolation tree, and uploads the latest isolation tree to the roadside unit in the processing layer. Step 3: The roadside units in the processing layer filter the latest isolated trees uploaded by each vehicle, select high-quality isolated trees to aggregate into a high-quality isolated forest, thereby achieving adaptive model updates. The specific steps are as follows: Based on the latest isolated tree linked lists uploaded by each vehicle, the roadside unit RSU1 calculates the performance index M of the isolated tree according to its own local CAN bus dataset d. IT Performance metrics M of the benchmark model base And based on the performance metrics obtained from Algorithm 1, malicious isolated trees were selected; Algorithm 1: Sets the threshold as the performance index M of the benchmark model. base -Tolerance for malicious actors e Among them, the performance index M of the benchmark model base Including accuracy, recall, precision, or F1 score, when the performance metric M of an isolated tree... IT If the value falls below a set threshold, the isolated tree is determined to be malicious. The performance metric v of the isolated tree is... IT The category and performance index M of the benchmark model base Consistent, 0≤thr e <M base ,thr e The smaller the value, the lower the tolerance. If a vehicle uploads more than 50% of its isolated trees as malicious isolated trees, the vehicle will be marked as a malicious participant. After that, the isolated trees uploaded by the vehicle will be directly discarded, and it will eventually be unable to obtain the latest high-quality isolated forest. After discarding malicious isolated trees, the roadside unit RSU1 checks whether the feature dimension of the isolated tree is consistent with the dimension of the baseline model. If they are inconsistent, it will select isolated trees with complementary feature dimensions and merge them. After merging isolated trees in the roadside unit RSU1, high-quality isolated trees GIT will be selected based on the local CAN bus dataset d using Algorithm 2 and added to the high-quality isolated forest GIF as the updated model. Algorithm 2: First, calculate the accuracy (ACC) of the isolated tree. IT Outlier score difference (ASG) with isolated trees IT If the accuracy of the isolated tree is ACC IT The accuracy ACC of the benchmark model is greater than that of the benchmark model. base And the outlier score difference (ASG) of isolated trees IT Outlier score difference greater than the baseline model (ASG) base If so, then this isolated tree is determined to be a high-quality isolated tree; The calculation method for the outlier score difference (ASG) is as follows: ASG=|μ a -m n | Where, μ a μ is the mean anomaly score of all abnormal data in the CAN bus dataset d on the model. n It is the mean of the abnormal scores on the model for all normal data in the CAN bus dataset d; Step 4: The roadside unit in the processing layer distributes the high-quality isolated forest to each vehicle. When a vehicle is outside the communication range of the roadside unit, the high-quality isolated forest will be forwarded by the roadside unit in the relay layer. Step 5: After each vehicle receives the high-quality isolated forest data from the roadside unit in the processing layer or relay layer, it performs anomaly detection on the CAN data frame to determine whether the CAN data frame is abnormal.

2. The method for detecting abnormal traffic in a vehicle network according to claim 1, characterized in that, Step 2 specifically includes: The vehicles at the terminal layer undergo distributed isolated tree training, and the vehicles at the terminal layer include normal vehicles c. i and malicious vehicles q i ; Normal vehicle c i : Utilizing the vehicle's local real-time CAN data frames i The isolated trees are trained using the isolated forest algorithm to obtain the latest benign isolated trees. And indicate the feature dimensions of the isolated tree. Training multiple benign isolated trees And stored in an isolated tree linked list uploaded by normal vehicles. middle; Malicious vehicle q i : Utilizing the abnormal CAN bus data set h i Malicious isolated trees trained using the isolated forest algorithm And indicate the feature dimensions used by the malicious isolated tree. Training multiple malicious isolated trees And stored in an isolated tree linked list uploaded by malicious vehicles. In the middle; the abnormal CAN bus data set h i Malicious traffic collected from the vehicle's CAN bus that has been subjected to a cyberattack; After the local isolated tree training is completed, each vehicle uploads its latest isolated tree list to the roadside unit RSU1. If edge vehicle e leaves the communication range of roadside unit RSU1, it will upload the local isolated tree list to roadside unit RSU2 in the relay layer within the communication range of the vehicle after training. After receiving the list, roadside unit RSU2 will send the isolated tree list uploaded by edge vehicle e to roadside unit RSU1.

3. The method for detecting abnormal traffic in a vehicle network according to claim 1, characterized in that, Step 4 specifically includes: After obtaining the latest high-quality isolated forest GIF, Roadside Unit RSU1 will distribute the updated model to other Roadside Units RSU2 and normal vehicles within its communication range that assist in forwarding the isolated tree list of edge vehicles. Among them, if an edge vehicle e leaves the communication range of Roadside Unit RSU1 and is regarded as a normal vehicle by Roadside Unit RSU1, the updated model will be distributed by Roadside Unit RSU2 within the communication range of edge vehicle e.

4. The method for detecting abnormal traffic in a vehicle network according to claim 1, characterized in that, Step 5 specifically includes: After the vehicle obtains the latest high-quality isolated forest GIF, it performs anomaly detection on the CAN data frame to be detected according to Algorithm 3. Algorithm 3: Based on the latest isolated forest model, the abnormal score of the CAN data frame to be detected is calculated and compared with the set abnormal score threshold. If the abnormal score is greater than the abnormal score threshold, the CAN data frame to be detected is determined to be abnormal.

5. A vehicle network abnormal traffic detection system based on the method of any one of claims 1 to 4, characterized in that, include: Baseline model training and isolated tree collection module: The roadside units in the processing layer form an isolated forest based on the isolated trees trained on the local CAN bus dataset, which serves as the baseline model. Then, the roadside units send requests to the vehicles to collect isolated trees. Each vehicle in the terminal layer calculates the isolation tree based on its latest CAN data frame, identifies the feature dimensions of the isolation tree, and uploads the latest isolation tree to the roadside unit in the processing layer. Model adaptive update module: The roadside unit in the processing layer filters the latest isolated trees uploaded by each vehicle, selects high-quality isolated trees to aggregate into a high-quality isolated forest, thereby realizing the adaptive update of the model; Model synchronization and relay forwarding module: The roadside unit in the processing layer distributes the high-quality isolated forest to each vehicle. When a vehicle is outside the communication range of the roadside unit, the roadside unit in the relay layer will forward the high-quality isolated forest on its behalf. Vehicle anomaly detection module: After each vehicle receives the high-quality isolated forest data from the roadside unit in the processing layer or relay layer, it performs anomaly detection on the CAN data frame to determine whether the CAN data frame is abnormal.

6. A vehicle-mounted network abnormal traffic detection device, characterized in that, include: Memory: for storing a computer program that implements the method for detecting abnormal traffic in a vehicle network as described in any one of claims 1 to 4; Processor: Used to implement the vehicle network abnormal traffic detection method as described in any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method for detecting abnormal traffic in a vehicle network as described in any one of claims 1 to 4.

Images