CAN bus intrusion detection method, system and electronic device

Abstract

The present invention belongs to the technical field of industrial control network communication security protection, and specifically relates to a CAN bus intrusion detection method, system, and electronic device. The method comprises: obtaining voltage sampling points on the CAN bus, extracting voltage sampling points with identifiers and IDE bit voltage sampling points from the voltage sampling points; converting the voltage sampling points with identifiers into message tags; determining dominant voltage sampling points from dominant bits among the IDE bit voltage sampling points, calculating the mean voltage of the dominant voltage sampling points, comparing the mean voltage with a preset threshold, and determining whether an intrusion has occurred based on the comparison result. By utilizing the key IDE bit voltage signal in the CAN message to establish the threshold and detect intrusions, the method avoids collecting a large number of signals in the CAN message that are not affected by the attack, reduces the number of sampling points, and significantly improves the accuracy of detecting covert attacks such as the DUET attack.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial control network communication security protection, and in particular relates to a CAN bus intrusion detection method, system and electronic equipment. Background Art

[0002] The Controller Area Network (CAN) bus, consisting of a twisted pair of CAN high and CAN low cables, offers excellent anti-interference capabilities and is widely used in ships, vehicles, aircraft, and other fields. However, due to the CAN bus's lack of encryption and authentication mechanisms, hackers who gain control of an electronic control unit (ECU) can exploit the CAN bus to attack other ECUs (Electrical Control Units) and manipulate their functions, threatening the safety of personnel and property. Therefore, intrusion detection on the CAN bus is essential.

[0003] Voltage-based intrusion detection systems (IDSs) have attracted widespread attention from researchers because they can identify the source of an attack. These solutions are effective in detecting common spoofing attacks (where an attacker ECU sends malicious messages containing the victim ECU's identifier). However, mainstream voltage-based IDSs require the acquisition of a significant portion of the voltage signal in a CAN message to detect an intrusion. This makes some subtle attacks, such as the DUET (Dual ECU Voltage Tampering Attack) attack, difficult to detect because it only disrupts a small amount of voltage signal at a time, thus compromising the ability of voltage-based IDSs to detect intrusions. Furthermore, given the limited resources of ECUs on the CAN bus, mainstream voltage-based IDSs require the calculation of numerous voltage signatures and the use of machine learning to build their systems. This makes timely detection of CAN messages difficult and hinders the ECU's ability to process and communicate CAN messages in real time. Summary of the Invention

[0004] The purpose of the present invention is to provide a CAN bus intrusion detection method, system and electronic device to solve the problems in the prior art of difficulty in detecting covert DUET attacks and high detection time cost.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] In a first aspect, the present invention provides a CAN bus intrusion detection method, comprising:

[0007] Obtain voltage sampling points on the CAN bus, extracting a first sampling point and a second sampling point; wherein the first sampling point is a voltage sampling point with an identifier; and the second sampling point is a voltage sampling point of the IDE bit;

[0008] Converting the first sampling point into a message label; determining a dominant voltage sampling point belonging to a dominant bit from the second sampling point, and calculating the mean voltage of the dominant voltage sampling point;

[0009] The mean voltage is compared with the preset threshold, and the comparison result is used to determine whether the CAN bus has been intruded. If an intrusion occurs, the invaded ECU is identified based on the message tag.

[0010] Preferably, the voltage sampling points on the CAN bus are differential signals.

[0011] Preferably, converting the first sampling point into a message label specifically includes converting the first sampling point into a digital signal expression form, and using the digital signal expression form as the message label.

[0012] Preferably, the comparison of the mean voltage with a preset threshold value and determining whether an intrusion has occurred based on the comparison result is specifically as follows:

[0013] If the average voltage is lower than the preset threshold, no intrusion occurs on the CAN bus;

[0014] If the average voltage is not lower than the preset threshold, the CAN bus is invaded.

[0015] Preferably, the preset threshold is obtained by the following steps:

[0016] Obtaining voltage sampling points on the CAN bus, and extracting a plurality of first sampling points and a plurality of second sampling points from the voltage sampling points; wherein each first sampling point corresponds to a second sampling point;

[0017] Converting the first sampling point into a message label; calculating the mean voltage of the second sampling point; wherein each message label corresponds to a mean voltage; classifying the mean voltages according to different types of message labels to obtain a fixed number of mean voltages; the fixed number of mean voltages and message labels constitute a training sample;

[0018] The following formula is used to calculate the training sample to obtain the preset threshold:

[0019]

[0020]

[0021] Where, is the preset threshold; is the upper quartile of the training sample; It is a preset parameter ranging from 8 to 70; is the lower quartile of the training sample; is the interquartile range.

[0022] A second aspect of the present invention provides a CAN bus intrusion detection system, comprising:

[0023] An acquisition unit is configured to acquire voltage sampling points on the CAN bus, and extract a first sampling point and a second sampling point; wherein the first sampling point is a voltage sampling point with an identifier; and the second sampling point is a voltage sampling point of an IDE bit;

[0024] The sample unit is configured to convert the first sampling point into a message label; determine a dominant voltage sampling point belonging to a dominant bit from the second sampling point, and calculate a mean voltage of the dominant voltage sampling point;

[0025] The intrusion detection unit compares the mean voltage with the preset threshold and determines whether an intrusion has occurred on the CAN bus based on the comparison result; when an intrusion occurs, the invaded ECU is identified based on the message tag.

[0026] Preferably, in the intrusion detection unit, the mean voltage is compared with a preset threshold value, and whether an intrusion occurs is determined based on the comparison result, specifically:

[0027] If the average voltage is lower than the preset threshold, no intrusion occurs on the CAN bus;

[0028] If the average voltage is not lower than the preset threshold, an intrusion occurs on the CAN bus.

[0029] Preferably, in the sample unit, converting the first sampling point into a message label specifically includes: converting the first sampling point into a digital signal, and using the digital signal as the message label.

[0030] According to a third aspect of the present invention, an electronic device is provided, comprising a processor and a memory, wherein the processor is configured to execute a computer program stored in the memory to implement any one of the above-mentioned CAN bus intrusion detection methods.

[0031] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, any one of the above-mentioned CAN bus intrusion detection methods is implemented.

[0032] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0033] 1) Technological innovation and covert attack detection

[0034] This invention utilizes the critical IDE (Identifier Extension) bit voltage signal in CAN messages to establish thresholds and detect intrusions, avoiding the need to sample a large number of signals in CAN messages that are unaffected by the attack. This technological innovation not only reduces the number of sampling points but also significantly improves the accuracy of detecting covert attacks such as the DUET attack. By learning the distribution of the mean IDE bit voltage in normal CAN messages and establishing a threshold for this bit for each identifier, the invention can effectively distinguish between normal messages and those corrupted by an attack. This makes the invention more accurate in detecting covert attacks.

[0035] 2) Increased detection speed and reduced hardware requirements

[0036] The present invention avoids using complex machine learning algorithms to train models and instead uses a threshold-based intrusion detection method to model normal messages. This significantly reduces the time overhead of intrusion detection. Test results on specific data sets show that the present invention significantly reduces the time for feature extraction, model training, and intrusion detection compared to traditional methods. Since only the voltage sampling point of the IDE bit needs to be obtained during the sampling process, the sampling rate required by the present invention is not high compared to traditional methods. This means that the present invention can be deployed on resource-constrained devices, further reducing the deployment cost of the intrusion detection system on the CAN bus. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are intended to explain the present invention and do not constitute an undue limitation of the present invention. In the accompanying drawings:

[0038] Figure 1 is a flow chart of a method according to an embodiment of the present invention;

[0039] Figure 2 This is an example diagram of a covert DUET attack according to an embodiment of the present invention;

[0040] Figure 3 is a system block diagram of an embodiment of the present invention;

[0041] Figure 4 The figure is a structural block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that, unless there is a conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0043] The following detailed description is an exemplary description, which is intended to provide further detailed description of the present invention. Unless otherwise indicated, all technical terms used in the present invention have the same meaning as those generally understood by those skilled in the art. The terms used in the present invention are only for describing specific embodiments, and are not intended to limit the exemplary embodiments according to the present invention.

[0044] See also Figure 1 , this application discloses a CAN bus intrusion detection method, comprising:

[0045] S1: Obtain voltage sampling points on the CAN bus and extract a first sampling point and a second sampling point; wherein the first sampling point is a voltage sampling point with an identifier; the second sampling point is a voltage sampling point of the IDE bit; extract the voltage sampling point with the identifier and the voltage sampling point of the IDE bit from the collected voltage sampling points. This is because the present application has found that for covert attacks, such as the DUET attack, the signal of the IDE bit will inevitably be affected by both the victim ECU and the attacker ECU.

[0046] S2: Convert the first sampling point into a message label; determine the dominant voltage sampling point belonging to the dominant bit from the second sampling point, and calculate the average voltage of the dominant voltage sampling point;

[0047] S3: Compare the mean voltage with the preset threshold and determine whether an intrusion has occurred based on the comparison result; if an intrusion has occurred, identify the invaded ECU based on the message tag.

[0048] This technology utilizes the critical IDE (Identifier Extension) bit voltage signal in CAN messages to establish thresholds and detect intrusions, avoiding the need to sample a large number of signals in CAN messages that are unaffected by the attack. This technological innovation not only reduces the number of sampling points but also significantly improves the accuracy of detecting covert attacks such as the DUET attack. By learning the distribution of the mean IDE bit voltage in normal CAN messages and establishing a threshold for this bit for each identifier, the present invention can effectively distinguish between normal messages and those compromised by attacks. This makes the present invention more accurate in detecting covert attacks.

[0049] In some embodiments, the voltage sampling point on the CAN bus is a differential signal, and the CAN bus includes a CAN high line and a CAN low line; the voltage sampling point on the CAN high line is a high sampling point, and the voltage sampling point on the CAN low line is a low sampling point; then the differential signal is obtained specifically as follows:

[0050] At the same time, the high sampling point voltage value on the CAN bus is subtracted from the low sampling point voltage value on the CAN bus to obtain a differential signal.

[0051] In some embodiments, converting voltage sampling points with identifiers into message labels specifically involves converting the voltage sampling points with identifiers into digital signal representations (i.e., signal representations consisting of 0s and 1s) based on the sampling rate at which the voltage sampling points were acquired, thereby obtaining the message labels. When an intrusion occurs, the compromised ECU is identified based on the identifier corresponding to the message label. Vehicle manufacturers maintain a mapping table that identifies each ECU and its identifier. After obtaining the identifier from the message label, the vehicle manufacturer can use the mapping table to identify the corresponding ECU.

[0052] In some embodiments, the mean voltage is compared with a preset threshold value, and whether an intrusion has occurred is determined based on the comparison result. The mean voltage in the sample of a normal message is lower than the threshold value, while the mean voltage in the sample of a malicious message exceeds the threshold value. Only one voltage sampling point with an identifier and one voltage sampling point of the IDE bit can be extracted from a message; then:

[0053] If the mean voltage is lower than the preset threshold, the message is a normal message and no intrusion occurs on the CAN bus;

[0054] If the mean voltage is not lower than the preset threshold, the message is an abnormal message and an intrusion occurs on the CAN bus.

[0055] In some embodiments, the preset threshold is obtained by the following steps:

[0056] Obtain voltage sampling points on the CAN bus, and extract a plurality of first sampling points and a plurality of second sampling points from the voltage sampling points; only one voltage sampling point with an identifier and one voltage sampling point of an IDE bit can be extracted from one message; therefore, each first sampling point obtained on the CAN bus corresponds to one second sampling point;

[0057] Convert the first sampling point into a message label; calculate the mean voltage of the second sampling point; wherein each message label corresponds to a mean voltage; classify the mean voltages according to different types of message labels to obtain a fixed number of mean voltages; the fixed number of mean voltages and the corresponding message labels constitute training samples;

[0058] The following formula is used to calculate the training sample to obtain the preset threshold:

[0059]

[0060]

[0061] Where, is the preset threshold; is the upper quartile of the training sample; It is a preset parameter, ranging from 8 to 70, preferably 8 to 38; is the lower quartile of the training sample; is the interquartile range.

[0062] Example 1

[0063] A CAN bus intrusion detection method comprises the following steps:

[0064] The voltage sampling points of normal CAN bus messages are collected. These voltage sampling points are differential signals. The voltage sampling points are obtained by subtracting the voltage value of the low sampling point on the CAN bus from the voltage value of the high sampling point on the CAN bus at the same moment. The number of sampling points is determined by the sampling rate; a higher sampling rate results in a greater number of sampling points. Preferably, the sampling rate can be 3.4 MS / s. From the collected voltage sampling points, the voltage sampling points with identifiers and the voltage sampling points of the IDE bit are extracted.

[0065] Convert the voltage sampling points with identifiers into message labels. On a 500 kbit / s CAN bus, the time required to transmit a single bit is 2 microseconds. Dividing the consecutive dominant sampling points (above 0.8V) and recessive sampling points (below or equal to 0.8V) by 6.8 yields the number of dominant bits (logical signal 0) and recessive bits (logical signal 1), thereby converting the voltage sampling points with identifiers into message labels. Determine the dominant voltage sampling points of the IDE bit and calculate the mean voltage of the dominant voltage sampling points.

[0066] The mean voltage is compared with the preset threshold value, and whether an intrusion has occurred is determined based on the comparison result. For example, assume that there are five types of messages with identifiers A, B, C, D, and E on the CAN bus, and their thresholds are 2.73, 2.51, 2.79, 2.57, and 2.63, respectively. If a message with identifier B is detected on the CAN bus, and its IDE bit mean voltage is 2.21, which is lower than the threshold value 2.51, then it means that the message is a normal message. If a message with identifier C is detected, and its IDE bit mean voltage is 3.02, which is higher than the threshold value 2.79, then it means that the message has been attacked and destroyed, and an intrusion has occurred on the CAN bus. At this time, the victim ECU is the ECU corresponding to identifier C. It is worth noting that although the present invention cannot directly know the identity of the victim ECU, the present invention can obtain the identifier corresponding to the victim ECU, which can help the manufacturer know the identity of the victim ECU based on the identifier.

[0067] The preset threshold is obtained by the following steps:

[0068] Obtain voltage sampling points on the CAN bus, and extract voltage sampling points with identifiers and voltage sampling points of IDE bits from the voltage sampling points;

[0069] Calculate the mean voltage of the voltage sampling points of the IDE bit and convert the voltage sampling points with identifiers into message labels. Classify the corresponding mean voltages according to different types of message labels to obtain a fixed number of mean voltages and message labels corresponding to the mean voltages. The fixed number of mean voltages and message labels corresponding to the mean voltages constitute training samples. For example, assume that there are five types of message labels on the CAN: A, B, C, D, and E. Classify the mean voltages according to the five message labels so that each type of message label has a fixed number of mean voltages. The fixed number of mean voltages and message labels corresponding to the mean voltages constitute training samples.

[0070] The training samples are calculated to obtain a preset threshold value, and the calculation method is as follows:

[0071]

[0072]

[0073] Where, is the preset threshold; is the upper quartile of the training sample; It is the preset parameter, take 38; is the lower quartile of the training sample; is the interquartile range.

[0074] For example, the number of training samples is 400. The preset threshold of the mean voltage of each identifier IDE bit is calculated, that is, ( ). IQR is the upper quartile of the data set ( ) and the lower quartile ( ), expressed as IQR= - Where k is a parameter to be set, ranging from 8 to 70. Preferably, k can be set to 8 to 38.

[0075] Example 2

[0076] See also Figure 3 , a CAN bus intrusion detection system, comprising:

[0077] An acquisition unit is configured to acquire voltage sampling points on the CAN bus, and extract a first sampling point and a second sampling point; wherein the first sampling point is a voltage sampling point with an identifier; and the second sampling point is a voltage sampling point of an IDE bit;

[0078] The sample unit is configured to convert the first sampling point into a message label; determine a dominant voltage sampling point belonging to a dominant bit from the second sampling point, and calculate a mean voltage of the dominant voltage sampling point;

[0079] The intrusion detection unit compares the mean voltage with the preset threshold and determines whether an intrusion has occurred on the CAN bus based on the comparison result; when an intrusion occurs, the invaded ECU is identified based on the message tag.

[0080] Further preferably, the system disclosed in this application also includes an alarm module and a display module. When no intrusion is detected, the system detects the next message. When an intrusion is detected, the system determines the identifier of the victim ECU and activates the alarm module, which issues an alarm via the display module or buzzer and displays the identifier of the victim ECU.

[0081] In some embodiments, the intrusion detection unit compares the mean voltage with a preset threshold value and determines whether an intrusion has occurred based on the comparison result, specifically:

[0082] If the average voltage is lower than the preset threshold, no intrusion occurs on the CAN bus;

[0083] If the average voltage is not lower than the preset threshold, an intrusion occurs on the CAN bus.

[0084] In some embodiments, in the sample unit, converting the first sampling point into a message label specifically includes converting the first sampling point into a digital signal, and using the digital signal as the message label.

[0085] Example 3

[0086] The error handling mechanism of the CAN bus stipulates that if multiple ECUs transmit different logical signals simultaneously after the arbitration field of the CAN message, bit errors will occur. Voltage-based intrusion detection systems are easily affected by environmental changes, resulting in a decrease in accuracy, so voltage-based intrusion detection systems need to be retrained frequently to update fingerprints. The DUET attack is a poisoning attack targeting the retraining process of voltage-based intrusion detection systems. The DUET attack destroys the signal bit by bit during the retraining period, quietly poisoning the model over a long period of time, and ultimately causing the attacker's ECU to send malicious messages without triggering an alarm. Because mainstream voltage-based intrusion detection systems collect most of the signals after the arbitration field to detect intrusions, the few signals destroyed by the DUET attack are masked by other normal signals collected, resulting in the attack not being detected. Figure 2 An example of the DUET attack is presented. Because the IDE bit signal is the first bit after the arbitration domain, the DUET attack corrupts the IDE bit signal in the first round. A corrupted IDE bit signal no longer originates from a single ECU, but rather from both the attacker ECU and the victim ECU. Therefore, the present invention can distinguish attacked messages by learning the average voltage value of each IDE bit in normal CAN messages.

[0087] The more sampling points there are, the higher the time cost of calculating them. Therefore, the present invention uses a lower sampling rate to obtain voltage sampling points. Furthermore, the present invention avoids using complex machine learning algorithms to train the model, opting for a threshold-based intrusion detection approach. This reduces the resource overhead required by the present invention.

[0088] Experimental environment:

[0089] Prototype System: This application constructed a prototype system consisting of seven ECUs. Given that ECUs in a real CAN network may come from different manufacturers, the prototype system integrates a variety of devices. Specifically, two Arduino UNOs and one Arduino Nano constitute three of the ECUs, each connected to an MCP2515 CAN controller and a TJA1050 CAN transceiver. Furthermore, a USBCAN-IIPro and three STM32F103 development boards with CAN modules constitute the remaining four ECUs. The prototype system includes two 500 kbit / s CAN high and CAN low lines.

[0090] Real Vehicles: This application considers an electric vehicle (BYD Dolphin), a hybrid vehicle (Buick Regal), and a gasoline vehicle (Luxgen U5). Three ECUs were connected to the CAN bus via the vehicle's OBD-II port. During the experiment, these three ECUs acted as the attacker and victim in the DUET attack, respectively. The technical solution disclosed in US11683323B2 was used as a comparative solution.

[0091] Table 1

[0092]

[0093] As shown in Table 1, this application uses three evaluation metrics (precision, recall, and F1-score) to demonstrate the performance of the comparative solution in detecting DUET attacks. The number of normal packets and packets corrupted by the DUET attack used for testing is 2000 each. Accuracy represents the proportion of packets correctly identified by the present invention relative to all packets. Recall represents the proportion of corrupted packets correctly identified by the present invention. The F1-score combines precision and recall to provide a balanced performance metric. Although the comparative solution detected a small number of corrupted packets during the DUET attack, the present invention outperformed the comparative solution in all three evaluation metrics during all rounds of the DUET attack. Although the comparative solution's accuracy is around 50%, this is primarily due to its ability to accurately identify normal signals. The comparative solution's recall reflects its weaker ability to identify packets corrupted by the DUET attack. The present invention utilizes the IDE bit signal to accurately distinguish between packets corrupted by the DUET attack and normal packets.

[0094] Table 2

[0095]

[0096] ECU resources on the CAN bus are limited, and the time for intrusion detection affects the real-time processing and real-time communication of messages by the ECU. In order to compare the time overhead of the present invention with that of the comparative solution, this application deploys both solutions on a RaspberryPi 4B. Since the present invention only calculates the mean voltage of the IDE bit, the time cost associated with feature extraction is reduced. The present invention avoids using complex machine learning algorithms to train the model and selects a threshold-based intrusion detection method. Referring to Table 2, it can be seen that compared with the comparative solution, the time for feature extraction, model training, and intrusion detection of the present invention is lower than that of the comparative solution.

[0097] Example 4

[0098] like Figure 4 As shown, the present invention also provides an electronic device 100 for implementing a CAN bus intrusion detection method;

[0099] The electronic device 100 includes a memory 101 , at least one processor 102 , a computer program 103 stored in the memory 101 and executable on the at least one processor 102 , and at least one communication bus 104 .

[0100] The memory 101 may be used to store a computer program 103 . The processor 102 implements the steps of Example 1 by running or executing the computer program stored in the memory 101 and calling data stored in the memory 101 .

[0101] The memory 101 may mainly include a program storage area and a data storage area. The program storage area may store an operating system, an application program required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data (such as audio data) created according to the use of the electronic device 100. In addition, the memory 101 may include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device.

[0102] The at least one processor 102 may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 102 may be a microprocessor or any conventional processor. The processor 102 is the control center of the electronic device 100 and connects various parts of the entire electronic device 100 using various interfaces and lines.

[0103] The memory 101 in the electronic device 100 stores multiple instructions to implement a CAN bus intrusion detection method, and the processor 102 can execute the multiple instructions to implement:

[0104] S1: Acquire the voltage sampling points on the CAN bus, and extract the voltage sampling points with identifiers and the voltage sampling points of the IDE bit from the voltage sampling points;

[0105] S2: Convert the voltage sampling point with the identifier into a message label; determine the dominant voltage sampling point from the dominant bit among the voltage sampling points of the IDE bit, calculate the average voltage of the dominant voltage sampling points, and the average voltage and the message label form a sample;

[0106] S3: Compare the sample with the preset threshold and determine whether an intrusion occurs based on the comparison result.

[0107] Example 5

[0108] If the modules / units integrated in the electronic device 100 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and when the computer program is executed by the processor, it can implement the steps of the above-mentioned method embodiments. Among them, the computer program includes computer program code, and the computer program code can be in the form of source code, object code, executable file or some intermediate form. The computer-readable medium may include: any entity or device that can carry computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory and read-only memory (ROM, Read-Only Memory).

[0109] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0110] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0111] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0112] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0113] Throughout this specification, references to terms such as "one embodiment," "example," or "specific example" indicate that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of the present invention. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0114] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. A CAN bus intrusion detection method, characterized in that: include: Obtain voltage sampling points on the CAN bus, extracting a first sampling point and a second sampling point; wherein the first sampling point is a voltage sampling point with an identifier; and the second sampling point is a voltage sampling point of the IDE bit; Converting the first sampling point into a message label; determining a dominant voltage sampling point belonging to a dominant bit from the second sampling point, and calculating the mean voltage of the dominant voltage sampling point; Compare the mean voltage with the preset threshold and determine whether the CAN bus has been intruded based on the comparison result. If an intrusion occurs, identify the invaded ECU based on the message tag. The mean voltage is compared with a preset threshold value, and whether an intrusion has occurred is determined based on the comparison result, specifically: If the average voltage is lower than the preset threshold, no intrusion occurs on the CAN bus; If the average voltage is not lower than the preset threshold, the CAN bus is invaded; The preset threshold is obtained by the following steps: Obtaining voltage sampling points on the CAN bus, and extracting a plurality of first sampling points and a plurality of second sampling points from the voltage sampling points; wherein each first sampling point corresponds to a second sampling point; Converting the first sampling point into a message label; calculating the mean voltage of the second sampling point; wherein each message label corresponds to a mean voltage; classifying the mean voltages according to different types of message labels to obtain a fixed number of mean voltages; the fixed number of mean voltages and message labels constitute a training sample; The following formula is used to calculate the training sample to obtain the preset threshold: Where, is the preset threshold; is the upper quartile of the training sample; It is a preset parameter ranging from 8 to 70; is the lower quartile of the training sample; is the interquartile range.

2. A CAN bus intrusion detection method according to claim 1, characterized in that: The voltage sampling points on the CAN bus are differential signals.

3. A CAN bus intrusion detection method according to claim 1, characterized in that: The converting the first sampling point into a message label specifically includes: converting the first sampling point into an expression form of a digital signal, and using the expression form of the digital signal as the message label.

4. A CAN bus intrusion detection system, characterized in that: The steps of the CAN bus intrusion detection method according to any one of claims 1 to 3 can be implemented, and the system includes: An acquisition unit is configured to acquire voltage sampling points on the CAN bus, and extract a first sampling point and a second sampling point; wherein the first sampling point is a voltage sampling point with an identifier; and the second sampling point is a voltage sampling point of an IDE bit; The sample unit is configured to convert the first sampling point into a message label; determine a dominant voltage sampling point belonging to a dominant bit from the second sampling point, and calculate a mean voltage of the dominant voltage sampling point; The intrusion detection unit compares the mean voltage with the preset threshold and determines whether an intrusion has occurred on the CAN bus based on the comparison result; when an intrusion occurs, the invaded ECU is identified based on the message tag.

5. A CAN bus intrusion detection system according to claim 4, characterized in that: In the sample unit, converting the first sampling point into a message label specifically includes: converting the first sampling point into a digital signal, and using the digital signal as the message label.

6. An electronic device, characterized in that: The system comprises a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement the CAN bus intrusion detection method according to any one of claims 1 to 3.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, the CAN bus intrusion detection method according to any one of claims 1 to 3 is implemented.

Images