CAN bus network intrusion detection method and system based on hybrid deep learning

Abstract

The present invention discloses a CAN bus network intrusion detection method and system based on hybrid deep learning. The present invention constructs a UNET-Transformer model, which extracts spatial features in CAN bus data through an encoder and a decoder, and captures the time and sequence dynamics in the CAN bus data sequence through an attention layer, thereby realizing a comprehensive analysis of the spatial and temporal characteristics of the message frame. This joint modeling significantly enhances the ability to recognize complex patterns. The present invention also addresses the problem of data imbalance and combines a sliding window method to not only expand the training samples but also maintain the distribution characteristics of the original CAN data, thereby making full use of minority category data and avoiding adverse effects on the detection of rare attack categories. Therefore, the method proposed in the present invention avoids the limitations of traditional CNN's limited ability to process sequence features, and is more efficient than BiLSTM processing, making it suitable for real-time intrusion detection.

Description

Technical Field

[0001] The present invention relates to a CAN bus network intrusion detection method, and in particular to a CAN bus network intrusion detection method and system based on hybrid deep learning. Background Art

[0002] The Controller Area Network (CAN) is a communications protocol widely used in modern vehicles, primarily for data transmission between electronic control units (ECUs). Due to its low cost, high reliability, and real-time performance, the CAN bus has become a key communications technology for both traditional and autonomous vehicles. However, the CAN bus was not designed with security in mind and lacks built-in security mechanisms such as data encryption, authentication, and access control. This makes the CAN bus vulnerable to various cyberattacks. Attackers can send malicious packets through the CAN bus to control critical vehicle functions such as emergency braking, acceleration, and steering, posing a serious threat to the safety of the vehicle and its passengers.

[0003] In recent years, with the rapid development of vehicle electronics and intelligentization, the complexity of CAN bus networks has increased significantly. CAN bus data in modern vehicles not only includes the traditional CAN ID, Data Length Code (DLC), and Data Payload fields, but also introduces extended identifiers, larger data fields (such as 64-byte data in CAN FD), high-resolution timestamps, and detailed sensor information (such as GPS and accelerometers). These additional data fields have made CAN bus data even more complex, making it difficult for traditional intrusion detection systems (IDS) to effectively address cyberattacks in modern vehicles.

[0004] Existing CAN bus intrusion detection methods are mainly divided into the following categories:

[0005] 1. Fingerprint-based methods: These methods exploit the unique clock offset or signal characteristics of each ECU on the CAN bus to detect attacks. For example, by analyzing the ECU's clock offset, forged CAN messages can be detected. However, these methods have limitations, such as being susceptible to environmental factors (such as temperature fluctuations) and being unable to detect new attack types.

[0006] 2. Parameter-based methods: These methods detect abnormal behavior by monitoring traffic parameters within the CAN bus network, such as message frequency and data load distribution. For example, if an abnormal increase in the frequency of messages sent by a particular ECU is detected, it can be determined that the ECU may be under attack. However, these methods are computationally complex and highly sensitive to parameter settings, making them prone to false positives.

[0007] 3. Information-theoretic approaches: These methods utilize concepts from information theory (such as entropy and mutual information) to analyze the characteristics of CAN bus data and detect potential intrusions. For example, by calculating the entropy of CAN messages, it is possible to determine whether there is abnormal traffic. However, these methods have high data quality requirements and are limited in their effectiveness when processing complex data.

[0008] 4. Machine Learning-Based Methods: These methods utilize machine learning algorithms (such as support vector machines and random forests) to detect abnormal behavior on the CAN bus. For example, by training a classifier, CAN messages can be classified as normal or abnormal. However, these methods often rely on manually designed features and are less effective when working with imbalanced datasets.

[0009] Although the above methods can effectively detect attacks on the CAN bus in specific scenarios, they generally have the following problems:

[0010] Inadequate feature extraction: Existing IDS methods are mostly based on vehicle datasets before 2020. These datasets have fewer features and cannot effectively handle the complex CAN bus data in modern vehicles. CAN bus data in modern vehicles contains more fields and features, and the performance of traditional IDS methods is significantly reduced when processing this data.

[0011] High computing resource consumption: Many existing IDS methods rely on complex feature engineering and model training, resulting in high computing resource consumption and difficulty in real-time operation in resource-constrained vehicle systems.

[0012] Data imbalance problem: The attack data in the CAN bus is usually far less than the normal data, resulting in an unbalanced dataset. Traditional machine learning methods are less effective when processing unbalanced datasets.

[0013] Therefore, it is necessary to propose a more effective CAN bus network intrusion detection method. Summary of the Invention

[0014] To address the needs and challenges outlined in the background art, this present invention provides a CAN bus network intrusion detection method and system based on hybrid deep learning. By introducing the UNET-Transformer model, this invention simultaneously captures both spatial features (such as the CAN ID and data payload fields) and temporal features (such as message transmission order and temporal dependencies) of CAN bus data, significantly improving the accuracy and efficiency of intrusion detection. Furthermore, this invention incorporates the Minority Mode Oversampling (SMOTE) method and the sliding window approach to effectively address data imbalance and further enhance the model's detection capabilities.

[0015] The technical solutions of the present invention are as follows:

[0016] 1. A CAN bus network intrusion detection method based on hybrid deep learning

[0017] Step 1: preprocessing the collected real-time CAN bus data to obtain a training data set; the real-time CAN bus data includes an injection data frame;

[0018] Step 2: Build a UNET-Transformer model and use the training data set to train the UNET-Transformer model to obtain a CAN bus network intrusion detection model;

[0019] Step 3: The CAN bus data to be tested is pre-processed and then input into the CAN bus network intrusion detection model, and the model outputs the intrusion detection result.

[0020] The step 1 is specifically as follows:

[0021] Firstly, the collected real-time CAN bus data is sequentially cleaned, labeled one-hot processed, and normalized to obtain normalized CAN bus data. Secondly, the normalized CAN bus data is enhanced using a minority oversampling method to obtain data-enhanced CAN bus data, in which the number of samples with different labels is balanced. Finally, missing values ​​in the data-enhanced CAN bus data are filled to obtain a training dataset, in which each training sample is a CAN bus message sequence consisting of K consecutive frames of CAN bus data.

[0022] Filling missing values ​​in the data-enhanced CAN bus data specifically includes:

[0023] A sliding window is used to select the same feature of K consecutive frames, and the average value of the non-missing values ​​in the sliding window is calculated and used as the filling feature of the missing values ​​in the sliding window. After traversing the missing values ​​in the CAN bus data after data enhancement, all missing values ​​are filled.

[0024] In step 2, the UNET-Transformer model includes an encoder, a decoder, a bottleneck unit and a classifier. The input of the UNET-Transformer model serves as the input of the encoder. The encoder is connected to the decoder after passing through the bottleneck unit, the decoder is connected to the classifier, and the output of the classifier serves as the output of the UNET-Transformer model. The encoder includes N sequentially connected convolution units, the decoder includes N sequentially connected upsampling units, the nth convolution unit is also connected to the N-n+1th upsampling unit, and n=1,…,N.

[0025] The convolution unit includes a first convolution layer, a first batch of normalization layers, a first maximum pooling layer and a first random inactivation layer which are connected in sequence.

[0026] The upsampling unit includes a second convolutional layer, a second batch normalization layer, and a second random dropout layer that are sequentially connected.

[0027] The bottleneck unit includes an attention layer, a normalization layer, a third batch normalization layer and a third random deactivation layer. The output of the encoder serves as the input of the attention layer. The output of the attention layer is added to its input and then input into the normalization layer. The normalization layer is connected to the third random deactivation layer after the third batch normalization layer. The output of the third random deactivation layer serves as the output of the bottleneck unit.

[0028] 2. A CAN bus network intrusion detection system based on hybrid deep learning

[0029] A preprocessing unit, used for preprocessing the collected real-time CAN bus data;

[0030] A training data set generating unit is used to process the CAN bus data in batches using the pre-processing unit, thereby generating a training data set;

[0031] A model storage unit is used to store the UNET-Transformer model and train the UNET-Transformer model using a training data set to obtain a CAN bus network intrusion detection model;

[0032] The intrusion detection unit is used to pre-process the CAN bus data to be tested and then input it into the CAN bus network intrusion detection model to obtain the intrusion detection result.

[0033] The pre-processing unit specifically includes:

[0034] Data cleaning unit, used for cleaning CAN bus data;

[0035] The tag one-hot processing unit is used to perform one-hot processing on tags in CAN bus data;

[0036] Normalization unit, used for normalizing the CAN bus data after data cleaning;

[0037] A data enhancement unit, used to perform data enhancement on the normalized CAN bus data using a few oversampling methods;

[0038] The missing value filling unit is used to fill the missing values ​​in the CAN bus data after data enhancement.

[0039] 3. A computer device

[0040] The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the steps of the CAN bus network intrusion detection method based on hybrid deep learning when executing the computer program.

[0041] Compared with the existing methods, the method proposed in the present invention has the following beneficial effects:

[0042] 1. This invention achieves a comprehensive analysis of the spatial and temporal characteristics of message frames by extracting spatial features (such as the CAN ID and data payload fields) through the encoder and decoder, and capturing temporal and sequential dynamics through the attention layer. This joint modeling significantly enhances the ability to recognize complex patterns.

[0043] 2. The method proposed in this paper avoids the limitation of traditional CNN in processing sequence features, and is more efficient than BiLSTM processing, making it suitable for real-time intrusion detection.

[0044] 3. To address the data imbalance problem, the present invention combines the sliding window and minority oversampling method (SMOTE), which not only expands the training samples but also maintains the distribution characteristics of the original CAN data, thereby making full use of minority category data and avoiding adverse effects on the detection of rare attack categories. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 Flow chart of the method of the present invention.

[0046] Figure 2 A sample diagram of an unbalanced dataset.

[0047] Figure 3 Schematic diagram of the network structure of the UNET-Transformer model.

[0048] Figure 4 This is the data preprocessing flow chart. DETAILED DESCRIPTION

[0049] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to illustrate and explain the present invention and are not intended to limit the present invention.

[0050] like Figure 1 As shown, the present invention proposes a CAN bus network intrusion detection method based on hybrid deep learning, which includes the following steps:

[0051] Step 1: Preprocess the collected real-time CAN bus data to obtain a training data set; the real-time CAN bus data contains injected data frames (i.e., abnormal data frames);

[0052] like Figure 4 As shown, step 1 is specifically as follows:

[0053] First, we collected CAN bus data in real time through the vehicle's OBD-II interface. Specifically, we collected data from two models, a Tesla Model 3 (2022) and a LeapMotor C10 (2024). The data included both normal data frames and injected anomalous data frames. The anomalous data frames included typical attack types, such as Denial of Service (DoS), Spoofing, and Fuzzy attacks. These attacks can seriously impact vehicle safety in real-world driving environments, placing strict demands on data preprocessing.

[0054] Real-time CAN bus data contains multiple characteristic fields, including the CAN ID field, data length code (DLC), data payload (DATA[0]-DATA[7]), and tag field (used to mark whether it is an attack frame). Among them, the CAN ID is used to identify the source and type of the message, the DLC indicates the data length of the message, and the data payload contains specific control information. The correctness of this information is directly related to the operational safety of the vehicle.

[0055] The collected real-time CAN bus data is then cleaned, labeled one-hot processed, and normalized to obtain the normalized CAN bus data.

[0056] Next, considering that in actual environments, there are far more normal data frames than abnormal data frames, and the data imbalance problem is serious, the minority oversampling method (SMOTE) is used to enhance the normalized CAN bus data to obtain the enhanced CAN bus data. The minority oversampling method analyzes the feature similarities and differences between minority class data points to synthesize new data points and solve the problem of imbalanced data sets. This method not only significantly increases the scale of training data, but also ensures the authenticity of the original feature distribution of the data, thereby effectively improving the model's ability to identify minority class attack data. The sample structure of the imbalanced data set is as follows: Figure 2 Therefore, the number of samples with different labels in the CAN bus data after data augmentation is balanced.

[0057] Finally, after filling the missing values ​​in the data-enhanced CAN bus data, a training data set is obtained. Each training sample in the training data set is a CAN bus message sequence consisting of K consecutive frames of CAN bus data.

[0058] During the data cleaning process, any noise and redundant fields that may exist in the raw data, such as timestamps, index numbers, and check digits, are removed, retaining only core features such as the CAN ID, DLC, and payload. This reduces data dimensionality and improves data quality, thereby making subsequent model training more efficient. During data collection, the label field is one-hot processed, marking normal data frames as 0 and abnormal data frames as 1. This label processing method clearly defines classification boundaries and can effectively improve the classification accuracy of deep learning models during training.

[0059] Because the numerical ranges of various features of CAN bus data vary widely, this can lead to numerical computation instability during model training. Therefore, the MinMaxScaler method is used in this embodiment to normalize all features to a range between 0 and 1. This normalization method not only ensures consistency in data processing but also increases the model's sensitivity to different data features, ensuring a more stable and effective model.

[0060] Fill missing values ​​in the CAN bus data after data enhancement, including:

[0061] A sliding window is used to select the same feature from K consecutive frames. The average of the non-missing values ​​within the sliding window is calculated and used as the filling feature for the missing values ​​within the sliding window. After traversing the missing values ​​in the data-augmented CAN bus data, all missing values ​​are filled. This method effectively ensures the integrity and consistency of the training data and avoids the negative impact of missing data on model performance.

[0062] In summary, the data preprocessing stage of the present invention ensures that the data input to the deep learning network is not only high-quality, feature-rich, and evenly distributed through the above rigorous and meticulous steps, so as to improve the accuracy and real-time performance of the model.

[0063] Step 2: Build a UNET-Transformer model and use the training data set to train the UNET-Transformer model to obtain a CAN bus network intrusion detection model;

[0064] This paper conducts in-depth optimization design based on the characteristics of complex CAN bus data features and tight spatial-temporal feature coupling, and proposes a UNET-Transformer model. The network structure diagram of the UNET-Transformer model is shown in the figure. Figure 3As shown. The UNET-Transformer model includes an encoder, a decoder, a bottleneck unit and a classifier. The input of the UNET-Transformer model serves as the input of the encoder. The encoder is connected to the decoder after passing through the bottleneck unit, and the decoder is connected to the classifier. The output of the classifier serves as the output of the UNET-Transformer model. The encoder is designed to gradually extract rich spatial feature information from the CAN bus data. The decoder is responsible for gradually reconstructing the high-level features extracted by the bottleneck unit into the spatial resolution of the original input data for the final intrusion detection classification. The encoder includes N sequentially connected convolution units, and the decoder includes N sequentially connected upsampling units. The nth convolution unit is also connected to the N-n+1th upsampling unit, n=1,…,N, that is, the Unet-Transformer network structure is adopted.

[0065] The convolution unit includes a first one-dimensional convolution layer, a batch normalization layer, a first maximum pooling layer, and a first random dropout layer connected in sequence. The output of the first random dropout layer is used as the output of each convolution unit. Specifically, the one-dimensional convolution layer effectively extracts fine-grained spatial local features in the CAN data by setting the number of filters and the size of the convolution kernel, such as the complex interaction information between the CAN ID field, the DLC field, and the data payload field (DATA[0]-DATA[7]); the batch normalization layer standardizes the feature map of the convolution output, effectively alleviating the gradient vanishing and gradient exploding problems during network training, and significantly improving the network training speed and stability; the maximum pooling layer is used to compress the feature dimension and highlight important local spatial features, thereby reducing the number of network parameters and reducing the computational burden; the random dropout layer randomly blocks the output of some neurons, effectively reducing the overfitting phenomenon of the network and improving the generalization performance of the network.

[0066] The bottleneck unit consists of an attention layer, a normalization layer, a third batch normalization layer, and a third dropout layer. The encoder output serves as the input to the attention layer, which is then added to the output and fed into the normalization layer, implementing a residual connection. The normalization layer is then connected to the third dropout layer after the third batch normalization layer. The output of the third dropout layer serves as the output of the bottleneck unit. The bottleneck unit utilizes an attention mechanism with powerful sequence feature modeling capabilities to efficiently capture the dynamic temporal features in CAN message sequences. Specifically, the spatial features output by the encoder are first fed into the attention layer, where the attention mechanism performs a weighted analysis of the temporal relationships within the sequence data, automatically learning the importance distribution characteristics within the data sequence. This attention mechanism dynamically weights and combines spatial features, enabling the network to sensitively identify key temporal features when processing continuous message sequences. These features, weighted and enhanced by the attention layer, are then fed into the normalization layer for feature standardization. They then pass through batch normalization and dropout layers, ultimately outputting a rich spatial-temporal feature representation. Through the effective integration of these multiple layers, the bottleneck unit comprehensively improves the network's ability to represent the complex sequence relationships in CAN bus data.

[0067] The upsampling unit consists of a second one-dimensional convolutional layer, a second batch normalization layer, and a second dropout layer, connected in sequence. The output of the corresponding convolutional unit serves as the input to the second convolutional layer. The one-dimensional convolutional layer effectively extracts and restores spatial feature details, the batch normalization layer ensures the stability of the feature recovery process, and the dropout layer prevents overfitting during feature reconstruction. The skip connection mechanism between the encoder and decoder directly connects the spatial features extracted by each encoder layer to the corresponding feature reconstruction layer of the decoder. This design not only effectively prevents the loss of spatial information in the bottleneck unit but also makes feature reconstruction more accurate, ensuring the overall performance of the network.

[0068] The Unet-Transformer network structure proposed in this invention effectively solves the limitations of traditional networks in processing spatial and temporal features separately through the organic collaboration and linkage between the encoder, bottleneck unit and decoder. It automatically and efficiently extracts the complex spatial-temporal feature relationship in CAN bus data without relying on manual feature engineering, eliminating the need for manual feature engineering. It not only greatly improves the network's recognition accuracy for different attack types, but also significantly improves the model's real-time reasoning capability in a resource-constrained vehicle environment, greatly enhancing its practical application value.

[0069] Each frame of CAN bus data includes priority (CAN ID), payload length (DLC), data payload (represented as 8 features), and label (1 for anomaly-injected frames and 0 for normal in-vehicle frames), for a total of 11 features. The encoder and decoder extract spatial features from each frame of CAN bus data, such as the CAN ID, DLC, and data payload (8 bytes, 64 bits in total, divided into 8 features), providing the necessary contextual information, enabling the model to distinguish normal operation from potential anomalies. The attention layer captures the timing and order of message transmission within a specified window, facilitating pattern recognition, anomaly detection, and assessment of message reception order, and is responsible for extracting temporal dependencies. This integrated focus on spatial and temporal dynamics enables a more advanced data representation, improving the model's ability to accurately identify benign traffic and potential intrusions. By examining message sequences rather than relying solely on absolute timing, the model significantly reduces false positive rates, thereby improving the reliability of intrusion detection in automotive environments.

[0070] Step 3: The CAN bus data to be tested is preprocessed (i.e., data cleaning and normalization) before being input into the CAN bus network intrusion detection model. The model outputs a binary intrusion detection result, which determines whether each data frame sequence is abnormal attack data or normal data. Specifically, the data to be tested undergoes rigorous preprocessing consistent with the training data before being input into the model. The model first extracts the spatial features of the data through the encoder. Next, the attention mechanism in the bottleneck unit dynamically evaluates and strengthens the temporal feature information in the data sequence. The decoder then reconstructs and classifies the comprehensive features to ensure that each frame in the data sequence can be accurately classified as normal or abnormal.

[0071] To evaluate the practical performance of the proposed model, we conducted extensive experimental validation on two vehicle datasets: the Tesla Model 3 (2022) and the LeapMotor C10 (2024), as well as a bus intrusion dataset. The model performed excellently, with specific performance metrics shown in Table 1. As can be seen from the table, the proposed method achieved extremely high levels of accuracy, precision, recall, and F1-score, demonstrating significant performance advantages. The confusion matrix shows that the model achieves extremely high accuracy in identifying DoS attacks, with a very low false positive rate. The model particularly excels in missed detections, detecting all attack scenarios and maintaining superior performance against two forgery attacks.

[0072] In summary, through detailed data preprocessing steps, carefully designed network model structure and comprehensive analysis of model output results, the present invention effectively realizes the efficient identification and classification of CAN bus intrusion data, significantly improves the real-time detection capability and accuracy of automotive network security, and is particularly suitable for the high-performance requirements of real-time intrusion detection in modern complex vehicle environments.

[0073] Table 1 shows the performance indicators of the method proposed in this invention.

[0074]

[0075] The present invention also proposes a CAN bus network intrusion detection system based on hybrid deep learning, comprising:

[0076] The preprocessing unit is used to perform data preprocessing on the collected real-time CAN bus data.

[0077] The training data set generating unit is used to process the CAN bus data in batches using the pre-processing unit to generate a training data set.

[0078] A model storage unit is used to store the UNET-Transformer model and train the UNET-Transformer model using a training data set to obtain a CAN bus network intrusion detection model;

[0079] The intrusion detection unit is used to pre-process the CAN bus data to be tested and then input it into the CAN bus network intrusion detection model to obtain the intrusion detection result.

[0080] The pre-processing unit specifically includes:

[0081] The data cleaning unit is used to clean the CAN bus data.

[0082] The tag one-hot processing unit is used to perform one-hot processing on tags in CAN bus data.

[0083] The normalization unit is used to normalize the CAN bus data after data cleaning.

[0084] The data enhancement unit is used to perform data enhancement on the normalized CAN bus data using a minority oversampling method.

[0085] The missing value filling unit is used to fill the missing values ​​in the CAN bus data after data enhancement.

[0086] Finally, it should be noted that the above embodiments and explanations are intended only to illustrate the technical solutions of the present invention and are not intended to limit the present invention. It should be understood by those skilled in the art that modifications or equivalent substitutions to the technical solutions of the present invention may be made without departing from the spirit and scope of the technical solutions disclosed herein, and all such modifications or equivalent substitutions shall be encompassed within the scope of protection of the claims of the present invention.

Claims

1. A CAN bus network intrusion detection method based on hybrid deep learning, characterized in that: The following steps are involved: Step 1: Preprocess the collected real-time CAN bus data to obtain a training data set; The real-time CAN bus data includes an injection data frame; Step 2: Build a UNET-Transformer model and use the training data set to train the UNET-Transformer model to obtain a CAN bus network intrusion detection model; Step 3: Pre-process the CAN bus data to be tested and then input it into the CAN bus network intrusion detection model, and the model outputs the intrusion detection results; The step 1 is specifically as follows: First, the collected real-time CAN bus data is cleaned, labeled one-hot processed, and normalized in sequence to obtain normalized CAN bus data. Then, a minority oversampling method is used to enhance the normalized CAN bus data to obtain enhanced CAN bus data. The number of samples of different labels in the enhanced CAN bus data is balanced. Finally, after filling the missing values ​​in the data-enhanced CAN bus data, a training data set is obtained, where each training sample in the training data set is a CAN bus message sequence consisting of K consecutive frames of CAN bus data. Filling missing values ​​in the data-enhanced CAN bus data specifically includes: A sliding window is used to select the same feature of K consecutive frames, and the average value of the non-missing values ​​in the sliding window is calculated and used as the filling feature of the missing values ​​in the sliding window. After traversing the missing values ​​in the CAN bus data after data enhancement, all missing values ​​are filled. In step 2, the UNET-Transformer model includes an encoder, a decoder, a bottleneck unit and a classifier. The input of the UNET-Transformer model serves as the input of the encoder. The encoder is connected to the decoder after passing through the bottleneck unit, the decoder is connected to the classifier, and the output of the classifier serves as the output of the UNET-Transformer model. The encoder includes N sequentially connected convolution units, the decoder includes N sequentially connected upsampling units, the nth convolution unit is also connected to the N-n+1th upsampling unit, and n=1,…,N.

2. A CAN bus network intrusion detection method based on hybrid deep learning according to claim 1, characterized in that: The convolution unit includes a first convolution layer, a first batch of normalization layers, a first maximum pooling layer and a first random inactivation layer which are connected in sequence.

3. A CAN bus network intrusion detection method based on hybrid deep learning according to claim 1, characterized in that: The upsampling unit includes a second convolutional layer, a second batch normalization layer, and a second random dropout layer that are sequentially connected.

4. The CAN bus network intrusion detection method based on hybrid deep learning according to claim 1 is characterized in that: The bottleneck unit includes an attention layer, a normalization layer, a third batch normalization layer and a third random deactivation layer. The output of the encoder serves as the input of the attention layer. The output of the attention layer is added to its input and then input into the normalization layer. The normalization layer is connected to the third random deactivation layer after the third batch normalization layer. The output of the third random deactivation layer serves as the output of the bottleneck unit.

5. A CAN bus network intrusion detection system based on hybrid deep learning, characterized in that: include: A preprocessing unit, used for preprocessing the collected real-time CAN bus data; A training data set generating unit is used to process the CAN bus data in batches using the pre-processing unit, thereby generating a training data set; A model storage unit is used to store the UNET-Transformer model and train the UNET-Transformer model using a training data set to obtain a CAN bus network intrusion detection model; The UNET-Transformer model includes an encoder, a decoder, a bottleneck unit, and a classifier. The input of the UNET-Transformer model serves as the input of the encoder. The encoder is connected to the decoder after passing through the bottleneck unit, and the decoder is connected to the classifier. The output of the classifier serves as the output of the UNET-Transformer model. The encoder includes N sequentially connected convolution units, and the decoder includes N sequentially connected upsampling units. The nth convolution unit is also connected to the N-n+1th upsampling unit, where n=1,…,N. The intrusion detection unit is used to pre-process the CAN bus data to be tested and then input it into the CAN bus network intrusion detection model to obtain the intrusion detection result; The pre-processing unit specifically includes: Data cleaning unit, used for cleaning CAN bus data; The tag one-hot processing unit is used to perform one-hot processing on tags in CAN bus data; Normalization unit, used for normalizing the CAN bus data after data cleaning; A data enhancement unit, used to perform data enhancement on the normalized CAN bus data using a few oversampling methods; The missing value filling unit is used to fill the missing values ​​in the CAN bus data after data enhancement.

6. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the steps of a CAN bus network intrusion detection method based on hybrid deep learning as described in any one of claims 1 to 4.

Images