CAN bus intrusion detection method and system based on temperature sensor equipment

Abstract

The present invention discloses a CAN bus intrusion detection method and system based on a temperature sensor device, which belongs to the field of industrial control network communication security protection technology. The method first collects the voltage data and temperature data of the CAN bus in real time, and pre-processes the voltage data to extract the voltage characteristics and the corresponding ECU nodes. Subsequently, a pre-trained voltage fingerprint model corresponding to the temperature range is dynamically loaded according to the real-time temperature data, and the voltage characteristics are input into the model to obtain the membership probability of each ECU node. Finally, an abnormality warning is performed based on these membership probabilities. The training process of the voltage fingerprint model includes temperature range division, training data set selection and SVM model training, thereby obtaining multiple voltage fingerprint models for different temperature ranges. This method realizes efficient and accurate CAN bus intrusion detection by comprehensively utilizing temperature and voltage data.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial control network communication security protection, and relates to a CAN bus intrusion detection method and system based on temperature sensor equipment. Background Art

[0002] With the rapid advancement of technology, industrial control networks are gradually evolving towards intelligence and interconnection. In this process, the Controller Area Network (CAN) protocol, as the core communication bus for industrial automation equipment, plays a crucial role. With its excellent real-time performance and anti-interference capabilities, the CAN bus continues to be responsible for transmitting critical control commands and sensor data in industrial fields such as intelligent manufacturing, process control, and robotic collaboration.

[0003] However, with the rise of the Industrial Internet of Things (IIoT) and cloud-edge collaborative architectures, the network security boundaries of traditional industrial CAN buses are facing unprecedented challenges. For one thing, industrial gateways' integrated remote monitoring interfaces, wireless communication modules, and access points for third-party devices expose the previously closed CAN bus system to more complex cross-protocol attack chains. Attackers can exploit these access points to infiltrate and disrupt the CAN bus, seriously threatening the security and stability of industrial control systems.

[0004] On the other hand, the CAN bus protocol itself has inherent security flaws. For example, the lack of message integrity verification mechanisms and node identity binding makes the broadcast communication architecture vulnerable to various security threats, including replay attacks and command injection. If these threats succeed, they can cause production system downtime or physical damage to equipment, resulting in significant financial losses and reputational damage to the company.

[0005] To address these security challenges, both academia and industry are actively seeking effective solutions. Intrusion detection technology based on physical layer feature analysis has become a research hotspot. This technology extracts the inherent physical characteristics of ECU (Electronic Control Unit) nodes, enabling precise location of attack sources and providing new insights into CAN bus security.

[0006] Among technologies based on physical layer feature analysis, voltage domain fingerprinting has attracted considerable attention due to its unique advantages. First, the physical unclonability of signal voltage signatures makes it difficult for attackers to forge or replicate authentic ECU node signatures, effectively combating security threats such as message replay attacks. Second, waveform signatures are inherently robust to bus load variations, preventing false positives caused by sudden changes in traffic flow and improving detection accuracy and reliability.

[0007] However, despite significant theoretical advantages, voltage-domain fingerprint recognition technology still faces challenges in practical engineering applications. In particular, in dynamic temperature scenarios, the supply voltage characteristics of ECU nodes can drift nonlinearly with ambient temperature fluctuations, leading to mismatches between the voltage fingerprint model and the real-time signal. This mismatch can severely impact detection accuracy and generalization capabilities, causing existing technologies to experience a drop in recognition accuracy of over 30% within the -10°C to 40°C temperature range.

[0008] Therefore, how to overcome the voltage fingerprint offset problem caused by temperature changes has become a core problem that needs to be solved urgently. Summary of the Invention

[0009] The purpose of the present invention is to solve the technical problem of voltage fingerprint deviation caused by temperature change in the prior art and to provide a CAN bus intrusion detection method and system based on a temperature sensor device.

[0010] In order to achieve the above object, the present invention adopts the following technical solutions:

[0011] A first aspect of the present invention provides a CAN bus intrusion detection method based on a temperature sensor device, comprising the following steps:

[0012] Real-time collection of CAN bus voltage and temperature data;

[0013] Preprocess the collected CAN bus voltage data to obtain the CAN bus voltage characteristics and the corresponding ECU nodes;

[0014] Based on the real-time collected temperature data, the voltage fingerprint model of the corresponding temperature range in the voltage fingerprint model cluster is dynamically loaded; the CAN bus voltage characteristics are input into the voltage fingerprint model of the corresponding temperature range to obtain the membership probability of the CAN bus voltage characteristics to all ECU nodes; the membership probability of the corresponding ECU node and the membership probability of other ECU nodes;

[0015] Based on the corresponding ECU nodes and CAN bus voltage characteristics, the membership probability of all ECU nodes is analyzed to provide abnormal warnings;

[0016] The training method of the voltage fingerprint model is specifically as follows:

[0017] The temperature is divided into intervals, and based on the divided temperature intervals, the voltage data of the CAN bus and the corresponding ECU nodes in the corresponding temperature intervals are selected as the training data set;

[0018] The training data sets in different temperature ranges are input into the SVM model for training respectively, and the voltage fingerprint models in different temperature ranges are obtained to form a voltage fingerprint model cluster.

[0019] Furthermore, the loss function of the voltage fingerprint model is to minimize cross entropy.

[0020] Furthermore, the hyperparameters of the voltage fingerprint model are optimized using k-fold cross validation.

[0021] Furthermore, the voltage fingerprint models of different temperature intervals are mapped one-to-one with the corresponding temperature intervals and stored in a temperature-model index table.

[0022] Furthermore, the voltage fingerprint models of different temperature ranges are stored using parameter differential compression technology.

[0023] Furthermore, based on the corresponding ECU nodes and CAN bus voltage characteristics, the membership probability of all ECU nodes is analyzed to provide abnormal warnings; specifically:

[0024] Setting a question counter to measure the legitimacy of the CAN bus voltage characteristics;

[0025] If the membership probability of the ECU node corresponding to the CAN bus voltage feature is greater than or equal to the trust threshold, the CAN bus voltage data is legal, and the updated question counter is reduced by 1;

[0026] If the membership probability of the ECU node corresponding to the CAN bus voltage feature is less than the trust threshold, the anomaly detection mechanism is triggered. The anomaly detection mechanism includes:

[0027] When the membership probability of other ECU nodes is greater than the warning threshold, the CAN bus voltage data is an internal attack;

[0028] When the value of the query counter is greater than the query threshold, the CAN bus voltage data is an external attack;

[0029] When the CAN bus voltage data is neither an internal attack nor an external attack, the question counter increases by 3.

[0030] A second aspect of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned CAN bus intrusion detection method based on a temperature sensor device when executing the computer program.

[0031] A third aspect of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the CAN bus intrusion detection method based on the temperature sensor device is implemented.

[0032] A fourth aspect of the present invention provides a computer program product, which includes computer instructions, and the computer instructions instruct a computer to execute the above-mentioned CAN bus intrusion detection method based on a temperature sensor device.

[0033] A fifth aspect of the present invention provides a CAN bus intrusion detection system based on a temperature sensor device, comprising:

[0034] Data acquisition module, real-time acquisition of CAN bus voltage data and corresponding temperature data;

[0035] The data preprocessing module preprocesses the collected CAN bus voltage data to obtain the CAN bus voltage characteristics;

[0036] The intrusion detection module dynamically loads the voltage fingerprint model of the corresponding temperature range in the voltage fingerprint model cluster based on the real-time collected temperature data; inputs the CAN bus voltage characteristics into the voltage fingerprint model of the corresponding temperature range to obtain the membership probability of the CAN bus voltage characteristics to all ECU nodes; the membership probability of the corresponding ECU node and the membership probability of other ECU nodes;

[0037] The early warning module issues abnormal warning based on the membership probability of all ECU nodes and the voltage characteristics of the corresponding ECU nodes and CAN bus.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] This invention discloses a CAN bus intrusion detection method based on a temperature sensor device. It proposes a dynamic voltage fingerprint model loading mechanism based on temperature intervals. By pre-training multiple voltage fingerprint models corresponding to different temperature intervals and dynamically loading the most appropriate model based on real-time collected temperature data, the detection model's effectiveness and adaptability are ensured in different temperature environments. This mechanism effectively addresses the problem of traditional static models experiencing performance degradation under complex environmental changes. A support vector machine (SVM) is used as the underlying algorithm for the voltage fingerprint model, and cross-entropy minimization is used as the loss function to ensure model optimization during training. Furthermore, a k-fold cross-validation method is introduced to optimize model hyperparameters, further improving the model's generalization and detection accuracy. These measures work together to ensure that the voltage fingerprint model maintains high detection performance even in complex and changing CAN bus environments. By mapping multiple trained voltage fingerprint models to their corresponding temperature intervals and storing them in an index table, rapid model search and recall are achieved. Furthermore, parameter differential compression technology is used to store model parameters, effectively reducing storage space and improving system efficiency. An abnormality warning mechanism based on membership probability is established. By configuring parameters such as the challenge counter, trusted threshold, and warning threshold, the legitimacy of CAN bus voltage signatures is dynamically assessed. When abnormal voltage signatures are detected, their source (internal or external attack) can be quickly determined and the corresponding warning mechanism triggered. This mechanism not only improves the real-time nature of intrusion detection but also provides strong support for subsequent security response. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0041] Figure 1 This is a flow chart of the CAN bus intrusion detection method based on a temperature sensor device of the present invention;

[0042] Figure 2 This is a structural diagram of the CAN bus intrusion detection system based on the temperature sensor device of the present invention;

[0043] Figure 3 This is a block diagram of a CAN bus intrusion detection system based on a temperature sensor device according to the present invention;

[0044] Figure 4 This is a working principle diagram of the data preprocessing module in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and illustrated in the drawings herein can be arranged and designed in various different configurations.

[0046] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but rather merely represents selected embodiments of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort are intended to fall within the scope of protection of the present invention.

[0047] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0048] The present invention is described in further detail below with reference to the accompanying drawings:

[0049] This embodiment discloses a CAN bus intrusion detection method based on a temperature sensor device. The implementation process of the overall method is as follows: Figure 1 As shown, the following steps are included:

[0050] S1. Collaborative multimodal data collection:

[0051] 1) Differential voltage signal acquisition: The deployment platform's integrated analog-to-digital converter (ADC) interface captures the CAN bus differential signal waveform in real time, enabling the acquisition of CAN bus voltage data. The CAN bus voltage signal is a differential signal at -5°C to 40°C.

[0052] 2) Dynamic Temperature Sensing and Acquisition: The deployment platform connects to a high-precision digital temperature sensor and establishes a temperature-voltage timestamp synchronization mechanism. A temperature-correlated sampling strategy is set during the acquisition process. When the temperature sensor receives a control acquisition signal, it samples a set of temperature data. Temperature data is collected synchronously by receiving the temperature acquisition signal.

[0053] S2. Preprocess the collected CAN bus voltage data to obtain CAN bus voltage characteristics and corresponding ECU nodes;

[0054] Preferably, the voltage value data is obtained by converting the original signal through voltage, and the voltage value data is sequentially subjected to SOF bit identification, ID decoding, random interleaved sampling and feature calculation to obtain voltage features; specifically including:

[0055] S201: converting the collected CAN bus voltage data into voltage value data through an ADC conversion formula;

[0056] S202: Identify the SOF bit in the voltage data. On the CAN bus, the start of a CAN message is marked by the Start of Frame (SOF) bit. Therefore, it is necessary to identify the SOF bit in the continuously collected voltage data. During the collection process, each time an SOF bit is identified, a temperature acquisition signal is sent to collect temperature data in real time.

[0057] S203: Based on the SOF bit and the CAN bus data pattern, the dominant bit of the voltage value data is identified, and the ID (identity) is obtained by decoding the dominant bit. Based on the ID and the known mapping relationship between the vehicle control unit (ECU) and the ID, the corresponding ECU is determined;

[0058] S204: splicing the voltage value data based on the identified dominant bit as a unit to form a rising edge, a dominant platform and a falling edge;

[0059] S205: According to the selected voltage characteristic calculation formula, the rising edge, dominant platform and falling edge formed in S204 are calculated in units of voltage value data to obtain the CAN bus voltage characteristic.

[0060] S3. Voltage fingerprint model training and deployment:

[0061] The voltage fingerprint model training is performed on a host computer, such as a personal computer (PC).

[0062] S301, training the model by temperature step: Based on the typical operating temperature range in the industrial control field (e.g., -10°C to 40°C), the temperature intervals are divided into preset fixed temperature steps (e.g., 5°C). For each temperature interval, the CAN bus voltage characteristics acquired and calculated in S1 and S2 are used as input, with the corresponding ECU nodes as labels to form a mapping dataset. An SVM model is trained using the mapping dataset of the CAN bus voltage characteristics and the corresponding ECU nodes. During training, the SVM model hyperparameters are optimized using k-fold cross-validation, minimizing cross-entropy as the loss function. The SVM model trained for each temperature interval dataset becomes the voltage fingerprint model for that temperature interval. The voltage fingerprint models for all temperature intervals form a voltage fingerprint model cluster.

[0063] S302 uses parameter differential compression technology to store the resulting voltage fingerprint model cluster. A temperature-model index table is created based on the correspondence between temperature ranges and voltage fingerprint models. Specifically, the complete parameter set is stored for the baseline model (e.g., the voltage fingerprint model for the 25°C range). For voltage fingerprint models in other temperature ranges, only parameter differences are stored.

[0064] S4. Intrusion Detection:

[0065] S401, real-time temperature matching detection: Based on the temperature-model index table, dynamically load the voltage fingerprint model of the corresponding temperature range according to the current sensor reading, perform fingerprint recognition on the voltage data, and obtain the membership probability of the ECU node corresponding to the CAN bus voltage feature and the membership probability of other ECU nodes, that is, the membership probability of the CAN bus voltage feature to all ECU nodes.

[0066] S402, issuing an abnormality warning based on the membership probability of the ECU node corresponding to the CAN bus message and the membership probability of other ECU nodes;

[0067] If the result of the judgment is that an attack has occurred, the embedded platform controls the buzzer to sound and issue an early warning. At the same time, the embedded platform controls the display screen to output the temperature, attack source and attack results.

[0068] One embodiment of the present invention provides a CAN bus intrusion detection method based on a temperature sensor device. This example uses an STM32H743ZIT6 microcontroller and a DS18B20 temperature sensor to implement CAN bus intrusion detection. The specific implementation process is as follows:

[0069] S1. Collaborative Multimodal Data Collection

[0070] 1) Differential voltage signal acquisition

[0071] The STM32H743ZIT6 microcontroller's built-in 12-bit ADC module, configured with a 5MHz sampling rate, collects CAN high and CAN low signals, ensuring coverage of CAN bus voltage fluctuations. The ADC uses continuous sampling mode to capture voltage waveforms, thus acquiring CAN bus voltage data.

[0072] 2) Dynamic temperature sensing and collection

[0073] A DS18B20 temperature sensor (±0.5°C accuracy) is connected to an STM32H743ZIT6 microcontroller via a single-wire bus protocol. After detecting the SOF bit in a CAN message, a sampling signal is sent, triggering the sensor to sample the temperature, ensuring that the temperature data is aligned with the message timestamp. Each message frame triggers a temperature acquisition, synchronously recording the temperature value (temperature data) and the corresponding message data (CAN bus voltage data).

[0074] S2. Voltage data preprocessing, see Figure 4 , the collected CAN bus voltage data is preprocessed to obtain the CAN bus voltage characteristics and the corresponding ECU nodes.

[0075] 1) Voltage conversion and calibration

[0076] Based on the 3.3V reference voltage of STM32H743ZIT6, the ADC raw sampling value is converted into the real voltage value through the two-point calibration method.

[0077] 2) SOF bit identification and ID decoding

[0078] The dominant bit threshold is set to 1.6V, and the recessive bit threshold is set to 0.6V. The falling edge of the SOF bit is located using an edge detection algorithm. When the distance between the rising and falling edges of the voltage is detected to be greater than 6 bits, the falling edge is considered the SOF bit. Starting from the SOF bit, 20 sampling points are calculated for each bit at a 500kbit / s rate (5MHz sampling rate). When decoding the ID, the ID is determined based on the standard CAN ID field length and combined with the preset ECU-ID mapping table (for example, ID 0x101 corresponds to the engine ECU) to complete ECU matching and obtain the corresponding ECU node.

[0079] 3) Random interleaved sampling

[0080] For message data in the same temperature range (±2.5°C), a random interleaved sampling strategy is adopted. Taking the message as the unit, the dominant bit, rising edge, and dominant bit in the same message are spliced ​​to increase the equivalent sampling rate to 25MHz.

[0081] 4) Feature extraction

[0082] Based on the sampling results and the voltage characteristic formula, the following CAN bus voltage characteristics are calculated: rising edge maximum value, complete bit roll-off rate, rising edge average deviation, falling edge roll-off rate, dominant bit flatness, rising edge kurtosis, falling edge skewness, complete bit spectrum kurtosis, complete bit irregularity, falling edge platform, and falling edge flatness.

[0083] S3. Voltage fingerprint model training and deployment

[0084] 1) Temperature step modeling

[0085] The voltage fingerprint model is trained on a host computer, such as a personal computer (PC). The temperature range is divided into -10°C and 40°C, with a step size of 5°C. The SVM model is trained independently in each temperature range. Training data selection requires that each ECU contain at least 2000 samples per temperature step. The input is the CAN bus voltage signature preprocessed by S2, and the output is the ECU node label. A temperature-model index table is stored in the STM32.

[0086] 2) Model deployment

[0087] The parameter differential compression technology is used to store the voltage fingerprint model cluster. The complete parameter set is saved for the benchmark model (such as the voltage fingerprint model in the 25℃ interval), and only the parameter differences are stored for the voltage fingerprint models in other temperature intervals.

[0088] 3) Dynamic model loading

[0089] The STM32 stores a temperature-model index table (for example, 0x00 corresponds to the -10°C to -5°C model address). During detection, a binary search is performed based on the current temperature sensor reading to find the voltage fingerprint model for the corresponding temperature range. During the loading process, the baseline model parameters and the difference value are combined in real time to create the voltage fingerprint model parameters for the corresponding temperature range, reducing storage space usage.

[0090] S4. Intrusion Detection and Response

[0091] 1) Real-time detection of internal attacks

[0092] Real-time collection of CAN bus voltage and temperature data;

[0093] Preprocess the collected CAN bus voltage data to obtain the CAN bus voltage characteristics and the corresponding ECU nodes;

[0094] Based on the real-time collected temperature data, the pre-trained voltage fingerprint model for the corresponding temperature range is dynamically loaded; the CAN bus voltage characteristics are input into the pre-trained voltage fingerprint model for the corresponding temperature range to obtain the membership probability of the ECU node corresponding to the CAN bus voltage characteristics and the membership probability of other ECU nodes;

[0095] According to the membership probability of the ECU node corresponding to the CAN bus message and the membership probability of other ECU nodes, abnormal warning is issued;

[0096] If the membership probability P of the ECU corresponding to the collected CAN bus voltage data is ECU Greater than or equal to the credible threshold T min=0.8, which means that the ECU node corresponding to the collected CAN bus voltage data is consistent with its voltage data content, and the voltage data is considered legal, and the degree of doubt of the voltage fingerprint model on this voltage data is reduced by reducing the doubt counter value. ECU Less than the credible threshold T min If the voltage data of the CAN bus collected by the current message is not consistent with the voltage data content of the corresponding ECU node, the collected CAN bus voltage data is considered to be abnormal and the next step of judgment is required:

[0097] In the case that the credibility of voltage data is questioned, the likelihood values ​​of other ECU nodes will be further compared. If the membership probability P of other ECU nodes is other Above the warning threshold T doubt =0.6, indicating that the source of the voltage data is identified as another ECU node. In this case, the voltage data is determined to be an internal attack and is marked as illegal.

[0098] 2) Attack warning mechanism

[0099] When an anomaly is detected, the GPIO triggers a buzzer (frequency 2kHz, duration 200ms), and the attack type (such as "ECU attack: ID 0x201") and the current temperature value (such as "Ambient temperature: 23.5°C") are output on the TFT display.

[0100] Another embodiment of the present invention provides a CAN bus intrusion detection system based on STM32 and temperature sensor for internal and external attacks. This example is based on STM32H743ZIT6 microcontroller and DS18B20 temperature sensor to implement a CAN bus intrusion detection system for internal and external attacks. The system consists of a data acquisition module, a data preprocessing module, an intrusion detection module and an early warning module. Figure 2As shown, connect the physical lines; connect the ADC pin of the STM32H743ZIT6 microcontroller to the high level of the CAN bus, and connect the low level of the CAN bus to the ground line of the STM32H743ZIT6 microcontroller; collect data through the voltage acquisition module, and the voltage data acquisition module transmits the data to the data preprocessing module through DMA (Direct Memory Access). The data preprocessing module transmits the temperature data to the data preprocessing module through the temperature sensor. The data preprocessing module stores the data through the SD card (Secure Digital Memory Card) and processes the data. The feature data obtained after preprocessing is transmitted to the intrusion detection module for detection. The detection result of the intrusion detection module enters the early warning module for early warning. The early warning module is provided with a buzzer and a liquid crystal display; the USB interface of the STM32H743ZIT6 microcontroller is used to communicate with the computer to realize code burning.

[0101] like Figure 3 As shown, the specific modules are as follows:

[0102] 1. Data acquisition module: collects CAN bus voltage data and corresponding temperature data in real time.

[0103] The CAN bus differential voltage signal is acquired using the 12-bit ADC module (reference voltage 3.3V) built into the STM32H743ZIT6 embedded platform. It supports an input range of 0–3.3V and adapts to the voltage characteristics of dominant bits (>1.6V) and recessive bits (<0.6V). The ADC is configured with a sampling rate of 5 MS / s, and clock-synchronized sampling is achieved through a timer trigger. Six temperature steps, each with a 5°C step size, are created within the ambient temperature range of [-5°C to 20°C]. Voltage data from eight ECUs are collected in each step (700 frames per ECU, for a total of 5600 frames). A DS18B20 temperature sensor (±0.5°C accuracy) communicates with the STM32 via a single-wire bus protocol, triggering temperature sampling upon detecting the SOF bit in the CAN message.

[0104] 2. Data preprocessing module: preprocesses the collected CAN bus voltage data to obtain the CAN bus voltage characteristics.

[0105] A random interleaved sampling algorithm increases the equivalent sampling rate to 25 MS / s, capturing detailed signal features. Voltage waveform reconstruction is performed based on the raw ADC sample values ​​and a 3.3V reference voltage. After identifying the SOF bit, the ID field is extracted and tag matching is performed using a pre-defined ECU-ID mapping table. CAN bus voltage characteristics are also calculated.

[0106] 3. Intrusion Detection Module: Based on the corresponding temperature data, a pre-trained voltage fingerprint model corresponding to the temperature step is selected. The CAN bus voltage characteristics are input into the pre-trained voltage fingerprint model corresponding to the temperature step to obtain the membership probability of the ECU node corresponding to the CAN bus voltage characteristics and the membership probability of other ECU nodes.

[0107] The intrusion detection module builds a voltage fingerprint model based on the support vector machine (SVM) algorithm, which includes the following submodules:

[0108] The voltage fingerprint submodule divides the training dataset into 5°C temperature steps (e.g., [-5°C, 0°C], [0°C, 5°C]), and independently trains the SVM model for each temperature interval. Parameter differential compression is used to store the model cluster. The baseline model (25°C) retains the complete support vector weights and bias parameters, while models for adjacent temperature intervals only store the differences from the baseline model. During deployment, the model parameter set is imported into the STM32 memory unit, and a temperature-model index table is established.

[0109] Real-time detection submodule:

[0110] 1) Temperature matching and model loading: Based on the temperature value collected in real time by the DS18B20 temperature sensor, the table is looked up to determine the current temperature range and the corresponding SVM model parameters are dynamically loaded;

[0111] 2) Feature input and classification reasoning: Receive the CAN bus voltage features output by the preprocessing module, and calculate the membership probability P of the ECU corresponding to the current message through the voltage fingerprint submodule ECU and the membership probabilities of other ECU nodes.

[0112] 4. Early warning module

[0113] Credibility determination: If P ECU ≥0.6 (credible threshold T min ), the message is judged to be legal, and the question counter value is reduced by 1; if P ECU <0.6, the anomaly detection mechanism is triggered;

[0114] Exception type identification:

[0115] Internal attack: When the second highest P other ≥0.85 (warning threshold T other ), it is determined to be a spoofing attack on the internal ECU, triggering the early warning module;

[0116] External attack: If P ECU If the value is less than 0.6 and the cumulative value of the query counter is ≥ 100, it is determined to be an external injection attack;

[0117] Pending confirmation: If the threshold is not reached, the question counter is incremented by 3, and subsequent legitimate messages are required to offset the accumulated value.

[0118] When an attack is detected, a buzzer alarm is triggered (frequency 2 kHz, duration 0.5 seconds) and an alarm message (ID: 0x7FF) is broadcast via the CAN bus. The LCD display simultaneously outputs the attack type (such as "Internal Attack: ECU3" or "External Attack: Unknown Source").

[0119] An embodiment of the present invention illustrates the advantages of the present invention through the following experiments, specifically:

[0120] Because in-vehicle networking is a key area of ​​CAN bus application, this experiment selected automobiles as the actual application scenario. To verify the effectiveness of the solution and eliminate the influence of real-world environmental factors, the experiment was conducted on both a real vehicle platform and a prototype system. The real vehicle platform used a Buick Regal as the test vehicle, whose ECUs were sourced from multiple suppliers, fully reflecting the heterogeneous characteristics of ECUs in actual vehicles. Hot start status data for the real vehicle was collected by driving the real vehicle for half an hour before data collection. Cold start status data for the real vehicle was collected when the engine was ignited at the beginning of data collection and the engine had not been started for an hour. To ensure the accuracy of temperature data, the experiment used a dual-redundancy solution with mercury thermometers and electronic thermometers for real-time monitoring.

[0121] To mitigate uncontrollable factors in a real-world vehicle environment, a prototype system was constructed as a supplementary verification platform. The prototype system consists of seven heterogeneous ECUs, including an STM32F103 development board, an Arduino Nano, and USBCAN-II Pro and CANalyst-II devices, simulating the heterogeneity of multi-vendor ECUs in real vehicles. The prototype system includes two 500 kbit / s CAN high and CAN low lines. The prototype system simulates temperature fluctuations and is equipped with a precision temperature control module to ensure precise control within the -10°C to 40°C temperature range. Bus characteristics were simulated using variable resistors and an identical network structure to ensure consistency between the experimental environment and the real CAN bus.

[0122] The experiment adopted a temperature-stepped data acquisition strategy, dividing the temperature range into 5°C steps (e.g., [-5, 0)°C, [0, 5)°C, ...), ensuring consistent data distribution within each temperature range. The actual vehicle platform, in both cold start and hot start modes, operates within a temperature range of -5°C to 20°C, divided into five temperature steps. Within each step, each ECU collects at least 1000 frames of data. The prototype system operates within a temperature range of -10°C to 40°C, divided into 10 temperature steps. Within each step, each ECU collects at least 2000 frames of data. These parameters ensure the adequacy and representativeness of the experimental data across different temperature ranges, providing a high-quality data foundation for subsequent model training and validation.

[0123] Table 1

[0124]

[0125] Note:

[0126] (1) Cold start experiment definition: when the engine is ignited during data collection, the engine has not been started within one hour;

[0127] (2) Definition of hot start experiment: When the engine is ignited during data collection, the engine has been running for more than half an hour;

[0128] (3) The ambient temperature change step refers to the size of the temperature interval divided by the ambient temperature when each data is collected.

[0129] To verify the temperature adaptability of the present invention, multi-dimensional testing was conducted using a prototype system and a real vehicle platform. The experiments used Scission and EASI as comparison methods, training models in fixed temperature ranges ([0, 5)°C and [15, 20)°C), respectively, for comparison with the present invention. The Scission method is based on Kneib M and Huth C. Scission: A Signal-Feature-Based Sender Identification and Intrusion Detection Method for In-Vehicle Networks [C]. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. The EASI method is based on U.S. Patent No. 11683323B2.

[0130] Table 2 shows the test results on the prototype system platform. Across the full temperature range of -10°C to 40°C, this solution maintained a stable accuracy of 99.7% to 100%, significantly outperforming traditional methods. For example, in the extremely low temperature range of [-10°C, -5°C], this solution achieved an accuracy of 99.7%, while the accuracy of the Scission and EASI models trained at [0°C, 5°C] dropped to 83.2% and 75.6%, respectively. In the high temperature range of [35°C, 40°C], this solution maintained 100% accuracy, while the comparison method's accuracy dropped below 87.8%. This phenomenon stems from the fact that the dynamic temperature-model matching mechanism effectively suppresses feature drift, while traditional methods struggle to cover the wide temperature range of feature distribution with a single model. In particular, in scenarios with sudden temperature changes (e.g., from [15°C, 20°C to [25°C, 30°C]), the comparison methods experienced an average drop of 21.6% (Scission's accuracy dropped from 97.4% to 90.2%), while this solution's accuracy fluctuated by only 0.1%, validating the decoupling capabilities of hierarchical modeling.

[0131] Table 2

[0132]

[0133] Experimental results on a real-vehicle cold-start platform, shown in Table 3, further demonstrate the advantages of this solution. In the temperature range of [5, 10°C], where temperatures fluctuate dramatically, this solution achieved an accuracy of 99%, while the comparison methods experienced a sharp drop (Scission achieved an accuracy of 66% and EASI achieved an accuracy of 54.8%). Notably, when the Scission model, trained at [15, 20°C], was tested in the range near [10, 15°C], its accuracy plummeted by 22%, while this solution maintained an accuracy of 99.8%, demonstrating that traditional methods are extremely sensitive to temperature boundaries.

[0134] Table 3

[0135]

[0136] The experimental results under hot start conditions, shown in Table 4, further demonstrate the advantages of this solution. In temperature fluctuation scenarios (e.g., [5, 10)°C), the proposed method maintains 100% accuracy, while the comparison method shows a decrease of 14% to 19%. More notably, when the EASI model trained at [15, 20)°C is tested at [-5, 0)°C, its hot start accuracy decreases by 19.2% compared to a cold start (68.3% to 49.1%), while the proposed solution only fluctuates by 0.8%. This demonstrates that the dynamic adaptation mechanism can effectively cope with the complex real-world environment and adapt to the effects of engine startup heat.

[0137] Table 4

[0138]

[0139] Combining the results of three experiments, we can see that this method exhibits two core advantages: 1) Full-temperature stability: The prototype system achieved 100% accuracy in eight of the 10 temperature steps, and the average accuracy of cold / hot start in a real vehicle exceeded 99.8%, an improvement of over 23.5 percentage points over traditional methods. 2) Boundary robustness: When switching between adjacent temperature zones (e.g., [15, 20°C] → [20, 25°C)), the comparative method experienced over 10% performance degradation due to model rigidification. However, this method, through dynamic model switching triggered by a temperature sensor, consistently maintained an error rate below 0.3%. Experimental results confirm that this method overcomes the traditional method's reliance on a fixed temperature range and addresses the voltage fingerprint drift caused by temperature changes during the testing phase, providing a more comprehensive solution for network security in the industrial control field.

[0140] In another embodiment of the present invention, an electronic device is provided, the electronic device including a processor and a memory, the memory being used to store a computer program, the computer program including program instructions, and the processor being used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., which is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to implement the corresponding method flow or corresponding function; the processor described in the embodiment of the present invention can be used for the operation of the CAN bus intrusion detection method based on the temperature sensor device.

[0141] In yet another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium. The computer-readable storage medium is a memory device in a terminal device, used to store programs and data. It is understood that the computer-readable storage medium herein may include both built-in storage media in the terminal device and, of course, extended storage media supported by the terminal device. It may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for being loaded and executed by a processor. These instructions may be one or more computer programs (including program code). It should be noted that more specific examples (a non-exhaustive list) of computer-readable storage media herein include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical fiber, a portable compact disk read-only memory, an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0142] Computer-readable storage media also include data signals propagated in baseband or as part of a carrier wave, which carry readable program code. Such propagated data signals can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable storage medium can also be any readable medium other than a readable storage medium, which can send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the readable storage medium can be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, etc., or any suitable combination of the above.

[0143] The program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network or a wide area network, or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0144] The processor may load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the CAN bus intrusion detection method based on the temperature sensor device in the above embodiment.

[0145] One embodiment of the present invention provides a computer program product, which includes computer instructions, wherein the computer instructions instruct a computer to execute the above-mentioned CAN bus intrusion detection method based on a temperature sensor device.

[0146] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A CAN bus intrusion detection method based on temperature sensor equipment, characterized in that: The following steps are involved: Real-time collection of CAN bus voltage and temperature data; The collected CAN bus voltage data is preprocessed to obtain the CAN bus voltage characteristics and the corresponding ECU nodes, specifically: The collected CAN bus voltage data is converted into voltage value data through the ADC conversion formula; Identify the SOF bit of the voltage value data; on the CAN bus, the start of the CAN message is marked by the frame start SOF bit; According to the SOF bit and the CAN bus data pattern, the dominant bit of the voltage value data is identified, and the ID is obtained by decoding the dominant bit. According to the ID, combined with the known mapping relationship between the vehicle control unit ECU and the ID, the corresponding ECU node is determined; The voltage value data is spliced ​​in units of the identified dominant bit to form a rising edge, a dominant platform and a falling edge; According to the selected voltage characteristic calculation formula, the rising edge, dominant platform and falling edge formed are calculated with voltage value data as the unit to obtain the CAN bus voltage characteristic; Based on the real-time collected temperature data, the voltage fingerprint model of the corresponding temperature range in the voltage fingerprint model cluster is dynamically loaded; the CAN bus voltage characteristics are input into the voltage fingerprint model of the corresponding temperature range to obtain the membership probability of the CAN bus voltage characteristics to all ECU nodes; the membership probability of the corresponding ECU node and the membership probability of other ECU nodes; Based on the corresponding ECU nodes and CAN bus voltage characteristics, the membership probability of all ECU nodes is analyzed to provide abnormal warnings, specifically: Setting a question counter to measure the legitimacy of the CAN bus voltage characteristics; If the membership probability of the ECU node corresponding to the CAN bus voltage feature is greater than or equal to the trust threshold, the CAN bus voltage data is legal, and the updated question counter is reduced by 1; If the membership probability of the ECU node corresponding to the CAN bus voltage feature is less than the trust threshold, the anomaly detection mechanism is triggered. The anomaly detection mechanism includes: When the membership probability of other ECU nodes is greater than the warning threshold, the CAN bus voltage data is an internal attack; When the value of the query counter is greater than the query threshold, the CAN bus voltage data is an external attack; When the CAN bus voltage data is neither an internal attack nor an external attack, the question counter increases by 3; The training method of the voltage fingerprint model is specifically as follows: The temperature is divided into intervals, and based on the divided temperature intervals, the voltage data of the CAN bus and the corresponding ECU nodes in the corresponding temperature intervals are selected as the training data set; The training data sets in different temperature ranges are input into the SVM model for training respectively, and the voltage fingerprint models in different temperature ranges are obtained to form a voltage fingerprint model cluster.

2. The CAN bus intrusion detection method based on temperature sensor equipment according to claim 1 is characterized in that: The loss function of the voltage fingerprint model is to minimize the cross entropy.

3. The CAN bus intrusion detection method based on temperature sensor equipment according to claim 1 is characterized in that: The hyperparameters of the voltage fingerprint model were optimized using k-fold cross validation.

4. The CAN bus intrusion detection method based on temperature sensor equipment according to claim 1 is characterized in that: The voltage fingerprint models of different temperature intervals are mapped one-to-one with the corresponding temperature intervals and stored in a temperature-model index table.

5. The CAN bus intrusion detection method based on temperature sensor equipment according to claim 1 or 4, characterized in that: The voltage fingerprint models in different temperature ranges are stored using parameter differential compression technology.

6. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the CAN bus intrusion detection method based on the temperature sensor device according to any one of claims 1 to 5 is implemented.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the CAN bus intrusion detection method based on a temperature sensor device according to any one of claims 1 to 5 is implemented.

8. A computer program product comprising computer instructions, characterized in that: The computer instructions instruct the computer to execute the CAN bus intrusion detection method based on a temperature sensor device according to any one of claims 1 to 5.

9. A CAN bus intrusion detection system based on a temperature sensor device, based on the CAN bus intrusion detection method based on a temperature sensor device according to claim 1, characterized in that: include: Data acquisition module, real-time acquisition of CAN bus voltage data and corresponding temperature data; The data preprocessing module preprocesses the collected CAN bus voltage data to obtain the CAN bus voltage characteristics; The intrusion detection module dynamically loads the voltage fingerprint model of the corresponding temperature range in the voltage fingerprint model cluster based on the real-time collected temperature data; inputs the CAN bus voltage characteristics into the voltage fingerprint model of the corresponding temperature range to obtain the membership probability of the CAN bus voltage characteristics to all ECU nodes; the membership probability of the corresponding ECU node and the membership probability of other ECU nodes; The early warning module issues abnormal warning based on the membership probability of all ECU nodes and the voltage characteristics of the corresponding ECU nodes and CAN bus.

Images