CAN bus intrusion detection method based on adaptive unscented Kalman filtering

Abstract

The invention discloses a CAN bus intrusion detection method based on adaptive unscented Kalman filtering, and the method comprises the steps: obtaining real-time message data, and carrying out the preprocessing of the real-time message data, and obtaining a time sequence feature vector; constructing a nonlinear state space model based on the time sequence feature vector; performing unscented Kalman filtering state prediction based on the nonlinear state space model; inputting the time sequence feature vector as an actual observation value, calculating a Kalman gain to correct an unscented Kalman filtering state prediction result, and outputting a state estimation residual error; dynamically updating a process noise covariance matrix through exponentially weighted moving average based on the state estimation residual, and adjusting a measurement noise covariance matrix according to the measurement innovation sequence; calculating the mahalanobis distance of the state estimation residual error, comparing the mahalanobis distance with a self-adaptive anomaly detection threshold value, and judging whether an intrusion behavior occurs or not; and if the abnormal score exceeds a threshold value, triggering a multi-level alarm mechanism, recording a suspicious message and executing a safety protection operation.

Description

Technical Field

[0001] The present invention relates to the field of vehicle network security, and in particular to a CAN bus intrusion detection method based on adaptive unscented Kalman filtering. Background Art

[0002] With the rapid advancement of intelligent and connected vehicles, the Controller Area Network (CAN) bus technology has become widely used for data communication between electronic control units (ECUs) in modern vehicles due to its high efficiency and real-time performance. However, the CAN bus communication protocol itself lacks a security authentication mechanism, and its broadcast communication mode makes it vulnerable to malicious attacks such as replay, flooding, and spoofing. These attacks can not only cause vehicle malfunctions but also pose a serious threat to the safety of the vehicle and its passengers.

[0003] Existing CAN bus intrusion detection methods primarily include rule-based and machine learning-based approaches. The former relies on predefined rules and is incapable of adapting to unknown attacks; the latter relies heavily on large amounts of historical data and cannot effectively capture dynamic changes in the CAN bus communication environment in real time. While the Unscented Kalman Filter (UKF) is suitable for nonlinear system state estimation, its fixed process and measurement noise covariances cannot adapt to the dynamic communication characteristics of the CAN bus, affecting the accuracy of anomaly detection.

[0004] The Chinese invention application with application number 202211471382.7 discloses "A method and system for intrusion detection of industrial control systems", which includes: determining the system matrix, control matrix, output matrix, observation noise covariance matrix, steady-state state covariance matrix and steady-state Kalman gain of the target system; the target system is the industrial control system to be detected; obtaining the original control signal at time k-1, the sensor data at time k and the sensor data at time k in the target system; the original control signal is the signal of the controller in the target system, and the sensor data is the data detected by the sensor in the target system; k>2; adding noise to the original control signal at time k-1 to obtain the noise-added signal at time k-1 moment; determining a priori estimate of the state vector at moment k based on the system matrix, the control matrix, the control signal at moment k-1 after noise addition, and the posterior estimate of the state vector at moment k-1; the posterior estimate of the state vector at moment k-1 is determined based on the output matrix, the steady-state Kalman gain, the sensor data at moment k-1, and the priori estimate of the state vector at moment k-2; determining a detection variable based on the prior estimate of the state vector at moment k, the output matrix, the sensor data at moment k, the steady-state state covariance matrix, and the observation noise covariance matrix; judging whether the detection variable is greater than a preset threshold; if so, the target system is invaded at moment k; if not, the target system is not invaded at moment k. Summary of the Invention

[0005] In order to solve the technical problem that the existing intrusion detection technology has insufficient dynamic threat detection capabilities, the present invention provides a CAN bus intrusion detection method based on adaptive unscented Kalman filtering. The technical solution adopted by the present invention is:

[0006] The present invention provides a CAN bus intrusion detection method based on adaptive unscented Kalman filtering to obtain real-time message data of CAN bus communication;

[0007] Preprocessing the real-time message data to obtain a time series feature vector;

[0008] constructing a nonlinear state space model based on the time series feature vector, wherein the nonlinear state space model includes a state equation and a measurement equation;

[0009] Performing unscented Kalman filter state prediction based on the nonlinear state space model;

[0010] The time series feature vector is input as the actual observation value, the Kalman gain is calculated to correct the unscented Kalman filter state prediction result, and the state estimation residual is output;

[0011] Based on the state estimation residual, dynamically updating the process noise covariance matrix by exponentially weighted moving average, and adjusting the measurement noise covariance matrix according to the measurement innovation sequence;

[0012] Calculating the Mahalanobis distance of the state estimation residual and comparing it with the adaptive anomaly detection threshold to determine whether an intrusion occurs;

[0013] If the anomaly score exceeds the threshold, a multi-level alarm mechanism is triggered, suspicious messages are recorded, and security protection operations are performed.

[0014] As a preferred solution, the method for extracting the communication characteristics of the real-time message data includes:

[0015] Let the i-th message be x i , contains the following fields:

[0016] x i ={ID i ,DLC i ,DATA i ,T i}

[0017] Among them, ID i is the message identifier, DLC i is the data length code, is the data field byte vector, T i is the timestamp;

[0018] Methods for normalizing communication features of different dimensions include:

[0019] The communication characteristics of each CAN message are standardized using the minimum-maximum normalization method;

[0020] Assume that the original communication characteristics of the i-th CAN message are:

[0021]

[0022] Where d is the characteristic dimension of each message, and the normalization formula is:

[0023]

[0024] in, is the minimum value of each dimension feature in the historical data; is the maximum value of each dimension feature in the historical data; the operation is element-by-element normalization, that is, for each dimension j:

[0025]

[0026] Normalized vector All characteristic information of each message is retained and used as state variable input in the subsequent state space model;

[0027] Methods for constructing time series feature vectors using the sliding window method include:

[0028] A fixed-length sliding window mechanism is used to perform temporal combination of continuous normalized messages to construct a state vector input sequence.

[0029] Assume that the sliding window length is W, that is, the system state at each moment is composed of the previous W consecutive messages. Then the state input vector constructed at time k is expressed as:

[0030]

[0031] in, represents the normalized feature vector of the tth message; x k It is the state vector after the sliding window is expanded, with W×d dimensions; each window slides forward one message in time to form a time series feature vector.

[0032] As a preferred solution, the expressions of the state equation and the measurement equation are:

[0033]

[0034] Among them, x k ∈R n is the system state variable; z k ∈R m is the observed variable; f(·) and h(·) are the nonlinear state transfer function and measurement function; Q k and R k are the process noise covariance matrix and the measurement noise covariance matrix respectively.

[0035] As a preferred solution, the system state variables include the transmission frequency characteristics, data load change characteristics and time interval characteristics of the CAN message.

[0036] As a preferred solution, the method for performing unscented Kalman filter state prediction based on the nonlinear state space model includes:

[0037] Based on the state estimate and state covariance matrix at the previous moment, the Sigma point set is generated using unscented transformation;

[0038] Through the state transfer equation, the Sigma point set is propagated to calculate the state prediction value and prediction covariance matrix at the current moment;

[0039] Based on the measurement equation, the projection of the Sigma point in the measurement space is calculated to obtain the measurement prediction value and the measurement covariance matrix.

[0040] As a preferred solution, a method for generating a Sigma point set using an unscented transformation based on the state estimate and the state covariance matrix at the previous moment includes:

[0041] The state dimension is n, and the parameters α, β, and κ are selected to calculate the scaling factor:

[0042]

[0043] Generate 2n+1 Sigma points:

[0044]

[0045] in, is the predicted value of the i-th Sigma point at the k-th moment, is the predicted state value of the i-th Sigma point at the k-th moment, P k-1 is the state covariance matrix of the previous moment, is the scaling factor, where λ = α 2 (n+κ)-n, The i-th column vector of the square root of the matrix;

[0046] The method of propagating the Sigma point set through the state transfer equation and calculating the state prediction value and prediction covariance matrix at the current moment includes:

[0047] Propagate each Sigma point through the state transfer function to obtain the current moment:

[0048]

[0049] in, Sigma point The propagation result after passing through the state transfer function f(·), f(·) is the system state transfer function, which describes how the system state evolves from the previous moment to the current moment;

[0050] Predicted state mean:

[0051]

[0052] in, is the predicted state mean at the current moment, is the weighted mean coefficient of the i-th Sigma point, satisfying is the i-th Sigma point after state propagation;

[0053] Forecast covariance matrix:

[0054]

[0055] in, is the current moment predicted state covariance matrix, is the covariance weight of the i-th Sigma point, is the predicted state mean, Q k is the process noise covariance matrix at the current moment, is the i-th Sigma point after state propagation prediction;

[0056] Based on the measurement equation, the method of calculating the projection of the Sigma point in the measurement space and obtaining the measurement prediction value and the measurement covariance matrix includes:

[0057] Map the Sigma point to the observation space:

[0058]

[0059] in, is the mapping value of the i-th Sigma point in the observation space; is the predicted value of the i-th Sigma point propagated to the k-th moment in the state space, h(·) is the system measurement function, which is used to map the state variables to observable quantities;

[0060] Compute the predicted observations and the measured covariance:

[0061]

[0062] in, is the predicted observation value at the kth moment, is the weighted mean of the observations of the i-th Sigma point; is the mapping result of the i-th Sigma point in the observation space, n is the state dimension, and the number of Sigma points is 2n+1;

[0063]

[0064] Among them, S k is the observation-forecast covariance matrix at the kth moment, is the covariance weight of the i-th Sigma point, is the Sigma point in the i-th observation space, is the predicted observation mean, R k is the measurement noise covariance matrix, which reflects the sensor error or system measurement uncertainty.

[0065] As a preferred solution, the method of inputting the time series feature vector as the actual observation value, calculating the Kalman gain to correct the unscented Kalman filter state prediction result, and outputting the state estimation residual includes:

[0066] Compute the state-observation cross-covariance matrix:

[0067]

[0068] Among them, P xz is the cross-covariance matrix between states and observations, is the predicted value of the i-th Sigma point in the state space, is the mapping result of the i-th Sigma point in the observation space, is the predicted state mean, is the predicted observation mean;

[0069] Calculate the Kalman gain and update the state and covariance:

[0070]

[0071] Among them, K k is the Kalman gain matrix at the kth moment, P xz is the cross-covariance matrix between states and observations, is the inverse of the measurement covariance matrix, used for weighted updates, is the updated estimated value of the system state, is the prediction residual (innovation term), P k is the updated state covariance matrix, is the predicted state covariance, S k is the predicted observation covariance matrix.

[0072] As a preferred solution, based on the state estimation residual, the method of dynamically updating the process noise covariance matrix by exponentially weighted moving average and adjusting the measurement noise covariance matrix according to the measurement innovation sequence includes:

[0073] Based on the state estimation residual The process noise covariance matrix Q k and the measurement noise covariance matrix R k Perform adaptive updates:

[0074]

[0075] Among them, α, β∈(0,1) are smoothing factors.

[0076] As a preferred solution, the method of calculating the Mahalanobis distance of the state estimation residual and comparing it with the adaptive anomaly detection threshold to determine whether an intrusion behavior has occurred includes:

[0077] Calculate the anomaly score:

[0078] The Mahalanobis distance is used to measure the strength of the deviation between the observation and the prediction:

[0079]

[0080] in, is the prediction residual at the kth moment; is the current prediction measurement covariance matrix; S anomaly is the abnormal score value at the current moment; where m represents the observation vector z k The dimension is the measurement features extracted from the CAN message at each moment;

[0081] This score measures the statistical consistency between the current observation and the prediction. If the system is operating normally, y k = has a mean of zero and a covariance of S k Gaussian distribution, so S anomaly Approximately follows a chi-square distribution with m degrees of freedom:

[0082] S anomaly ~χ 2 (m)

[0083] Make an exception judgment:

[0084] Setting the significance level δ, we can look up the table to obtain the critical value τ, so that:

[0085] P(S anomaly >τ)=δ

[0086] The exception judgment rule is:

[0087] S anomaly >τ

[0088] If it is abnormal, it will enter the alarm process; otherwise, it is considered that the current state is within the normal range.

[0089] Compared with the prior art, the present invention has the following beneficial effects:

[0090] The present invention enables the unscented Kalman filter to adapt to the dynamic changes of the CAN bus communication state by adjusting the noise covariance matrix in real time, thereby improving the accuracy and robustness of anomaly detection.

[0091] The present invention improves the detection capability of abnormal communication behaviors such as replay attacks, flooding attacks and deception attacks based on the abnormal score calculation method of state estimation residual.

[0092] The present invention utilizes an adaptive noise estimation algorithm to reduce computational complexity while ensuring detection accuracy, making the method suitable for real-time vehicle network security detection.

[0093] In summary, the method of the present invention achieves efficient and accurate detection of CAN bus anomalies by introducing an adaptive unscented Kalman filter, and is suitable for the fields of intelligent connected vehicles, autonomous driving systems, and vehicle network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0094] Figure 1 A flow chart of a CAN bus intrusion detection method based on adaptive unscented Kalman filtering is provided in this embodiment. DETAILED DESCRIPTION

[0095] The accompanying drawings are for illustrative purposes only and are not to be construed as limiting the present invention;

[0096] It should be clear that the embodiments described are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the embodiments of the present application.

[0097] The terms used in the embodiments of the present application are for the purpose of describing specific embodiments only and are not intended to limit the embodiments of the present application. The singular forms "a," "the," and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0098] When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims. In the description of the present application, it should be understood that the terms "first", "second", "third", etc. are only used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence, nor can they be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances.

[0099] In addition, in the description of this application, unless otherwise specified, "plurality" refers to two or more. "And / or" describes the relationship between associated objects, indicating that three relationships can exist. For example, "A and / or B" can mean: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship. The present invention is further described below with reference to the accompanying drawings and examples.

[0100] The present invention is further described below with reference to the accompanying drawings and embodiments.

[0101] Example 1

[0102] Please refer to Figure 1 This embodiment provides a CAN bus intrusion detection method based on adaptive unscented Kalman filtering, the method comprising the following steps:

[0103] S1: Get the real-time message data of CAN bus communication;

[0104] S2: Preprocessing the real-time message data to obtain a time series feature vector;

[0105] In a specific embodiment, the method of preprocessing the real-time message data to obtain a time series feature vector includes:

[0106] Extracting communication features of the real-time message data, the communication features including a message identifier, a data length code, a data field, and a message time interval;

[0107] Normalize communication features of different dimensions;

[0108] The sliding window method is used to construct the time series feature vector.

[0109] In a specific embodiment, the method for extracting the communication characteristics of the real-time message data includes:

[0110] Let the i-th message be x i , contains the following fields:

[0111] x i ={ID i ,DLC i ,DATA i ,T i}

[0112] Among them, ID i is the message identifier, DLC i is the data length code, is the data field byte vector, T i is the timestamp;

[0113] Methods for normalizing communication features of different dimensions include:

[0114] The communication characteristics of each CAN message are standardized using the minimum-maximum normalization method;

[0115] Assume that the original communication characteristics of the i-th CAN message are:

[0116]

[0117] Where d is the characteristic dimension of each message, and the normalization formula is:

[0118]

[0119] in, is the minimum value of each dimension feature in the historical data; is the maximum value of each dimension feature in the historical data; the operation is element-by-element normalization, that is, for each dimension j:

[0120]

[0121] Normalized vector All characteristic information of each message is retained and used as state variable input in the subsequent state space model;

[0122] Methods for constructing time series feature vectors using the sliding window method include:

[0123] A fixed-length sliding window mechanism is used to perform temporal combination of continuous normalized messages to construct a state vector input sequence.

[0124] Assume that the sliding window length is W, that is, the system state at each moment is composed of the previous W consecutive messages. Then the state input vector constructed at time k is expressed as:

[0125]

[0126] in, represents the normalized feature vector of the tth message; x k It is the state vector after the sliding window is expanded, with W×d dimensions; each window slides forward one message in time to form a time series feature vector.

[0127] S3: constructing a nonlinear state space model based on the time series feature vector, wherein the nonlinear state space model includes a state equation and a measurement equation;

[0128] In a specific embodiment, the state equation and the measurement equation are expressed as:

[0129]

[0130] Among them, x k ∈R n is the system state variable; z k ∈R m is the observed variable; f(·) and h(·) are the nonlinear state transfer function and measurement function; Q k and R kare the process noise covariance matrix and the measurement noise covariance matrix respectively.

[0131] S4: performing unscented Kalman filter state prediction based on the nonlinear state space model;

[0132] In a specific embodiment, the method for performing unscented Kalman filter state prediction based on the nonlinear state space model includes:

[0133] Based on the state estimate and state covariance matrix at the previous moment, the Sigma point set is generated using unscented transformation;

[0134] Through the state transfer equation, the Sigma point set is propagated to calculate the state prediction value and prediction covariance matrix at the current moment;

[0135] Based on the measurement equation, the projection of the Sigma point in the measurement space is calculated to obtain the measurement prediction value and the measurement covariance matrix.

[0136] In a specific embodiment, a method for generating a Sigma point set using an unscented transformation based on a state estimate and a state covariance matrix at a previous moment includes:

[0137] The state dimension is n, and the parameters α, β, and κ are selected to calculate the scaling factor:

[0138]

[0139] Generate 2n+1 Sigma points:

[0140]

[0141] in, is the predicted value of the i-th Sigma point at the k-th moment, is the predicted state value of the i-th Sigma point at the k-th moment, P k-1 is the state covariance matrix of the previous moment, is the scaling factor, where λ = α 2 (n+κ)-n, The i-th column vector of the square root of the matrix;

[0142] The method of propagating the Sigma point set through the state transfer equation and calculating the state prediction value and prediction covariance matrix at the current moment includes:

[0143] Propagate each Sigma point through the state transfer function to obtain the current moment:

[0144]

[0145] in, Sigma point The propagation result after passing through the state transfer function f(·), f(·) is the system state transfer function, which describes how the system state evolves from the previous moment to the current moment;

[0146] Predicted state mean:

[0147]

[0148] in, is the predicted state mean at the current moment, is the weighted mean coefficient of the i-th Sigma point, satisfying is the i-th Sigma point after state propagation;

[0149] Forecast covariance matrix:

[0150]

[0151] in, is the current moment predicted state covariance matrix, is the covariance weight of the i-th Sigma point, is the predicted state mean, Q k is the process noise covariance matrix at the current moment, is the i-th Sigma point after state propagation prediction;

[0152] Based on the measurement equation, the method of calculating the projection of the Sigma point in the measurement space and obtaining the measurement prediction value and the measurement covariance matrix includes:

[0153] Map the Sigma point to the observation space:

[0154]

[0155] in, is the mapping value of the i-th Sigma point in the observation space; is the predicted value of the i-th Sigma point propagated to the k-th moment in the state space, h(·) is the system measurement function, which is used to map the state variables to observable quantities;

[0156] Compute the predicted observations and the measured covariance:

[0157]

[0158] in, is the predicted observation value at the kth moment, is the weighted mean of the observations of the i-th Sigma point; is the mapping result of the i-th Sigma point in the observation space, n is the state dimension, and the number of Sigma points is 2n+1;

[0159]

[0160] Among them, S k is the observation-forecast covariance matrix at the kth moment, is the covariance weight of the i-th Sigma point, is the Sigma point in the i-th observation space, is the predicted observation mean, R k is the measurement noise covariance matrix, which reflects the sensor error or system measurement uncertainty.

[0161] S5: Input the time series feature vector as the actual observation value, calculate the Kalman gain to correct the unscented Kalman filter state prediction result, and output the state estimation residual;

[0162] In a specific embodiment, the method of inputting the time series feature vector as the actual observation value, calculating the Kalman gain to correct the unscented Kalman filter state prediction result, and outputting the state estimation residual includes:

[0163] Compute the state-observation cross-covariance matrix:

[0164]

[0165] Among them, P xz is the cross-covariance matrix between states and observations, is the predicted value of the i-th Sigma point in the state space, is the mapping result of the i-th Sigma point in the observation space, is the predicted state mean, is the predicted observation mean;

[0166] Calculate the Kalman gain and update the state and covariance:

[0167]

[0168] Among them, K k is the Kalman gain matrix at the kth moment, P xz is the cross-covariance matrix between states and observations, is the inverse of the measurement covariance matrix, used for weighted updates, is the updated estimated value of the system state, is the prediction residual (innovation term), P k is the updated state covariance matrix, is the predicted state covariance, Sk is the predicted observation covariance matrix.

[0169] S6: Based on the state estimation residual, dynamically update the process noise covariance matrix by exponentially weighted moving average, and adjust the measurement noise covariance matrix according to the measurement innovation sequence;

[0170] In a specific embodiment, the method of dynamically updating the process noise covariance matrix by exponentially weighted moving average based on the state estimation residual and adjusting the measurement noise covariance matrix according to the measurement innovation sequence includes:

[0171] Based on the state estimation residual The process noise covariance matrix Q k and the measurement noise covariance matrix R k Perform adaptive updates:

[0172]

[0173] Among them, α, β∈(0,1) are smoothing factors.

[0174] S7: Calculate the Mahalanobis distance of the state estimation residual, compare it with the adaptive anomaly detection threshold, and determine whether an intrusion behavior occurs;

[0175] In a specific embodiment, the method of calculating the Mahalanobis distance of the state estimation residual and comparing it with the adaptive anomaly detection threshold to determine whether an intrusion behavior has occurred includes:

[0176] Calculate the anomaly score:

[0177] The Mahalanobis distance is used to measure the strength of the deviation between the observation and the prediction:

[0178]

[0179] in, is the prediction residual at the kth moment; is the current prediction measurement covariance matrix; S anomaly is the abnormal score value at the current moment; where m represents the observation vector z k The dimension is the measurement features extracted from the CAN message at each moment;

[0180] This score measures the statistical consistency between the current observation and the prediction. If the system is operating normally, y k = has a mean of zero and a covariance of S k Gaussian distribution, so S anomaly Approximately follows a chi-square distribution with m degrees of freedom:

[0181] S anomaly ~χ2 (m)

[0182] Make an exception judgment:

[0183] Setting the significance level δ, we can look up the table to obtain the critical value τ, so that:

[0184] P(S anomaly >τ)=δ

[0185] The exception judgment rule is:

[0186] S anomaly >τ

[0187] If it is abnormal, it will enter the alarm process; otherwise, it is considered that the current state is within the normal range.

[0188] S8: If the anomaly score exceeds the threshold, a multi-level alarm mechanism is triggered, suspicious messages are recorded, and security protection operations are performed.

[0189] Example 2

[0190] Please refer to Figure 1 This embodiment provides a CAN bus intrusion detection method based on adaptive unscented Kalman filtering, the method comprising the following steps:

[0191] S1: Get the real-time message data of CAN bus communication;

[0192] S2: Preprocessing the real-time message data to obtain a time series feature vector;

[0193] In a specific embodiment, the method of preprocessing the real-time message data to obtain a time series feature vector includes:

[0194] Extracting communication characteristics of the real-time message data, wherein the communication characteristics include a message identifier (ID), a data length code (DLC), a data field (DATA), and a message time interval;

[0195] Normalize communication features of different dimensions;

[0196] The sliding window method is used to construct the time series feature vector.

[0197] In a specific embodiment, the method for extracting the communication characteristics of the real-time message data includes:

[0198] Let the i-th message be x i , contains the following fields:

[0199] x i ={ID i ,DLC i ,DATA i,T i}

[0200] Among them, Id i is the message identifier, DLC i is the data length code, is the data field byte vector, T i is the timestamp;

[0201] Methods for normalizing communication features of different dimensions include:

[0202] The communication characteristics of each CAN message are standardized using the minimum-maximum normalization method;

[0203] Assume that the original communication characteristics of the i-th CAN message are:

[0204]

[0205] Where d is the characteristic dimension of each message, and the normalization formula is:

[0206]

[0207] in, is the minimum value of each dimension feature in historical data; is the maximum value of each dimension feature in the historical data; the operation is element-by-element normalization, that is, for each dimension j:

[0208]

[0209] Normalized vector All characteristic information of each message is retained and used as state variable input in the subsequent state space model;

[0210] Methods for constructing time series feature vectors using the sliding window method include:

[0211] A fixed-length sliding window mechanism is used to perform temporal combination of continuous normalized messages to construct a state vector input sequence.

[0212] Assume that the sliding window length is W, that is, the system state at each moment is composed of the previous W consecutive messages. Then the state input vector constructed at time k is expressed as:

[0213]

[0214] in, represents the normalized feature vector of the tth message; x k It is the state vector after the sliding window is expanded, with W×d dimensions; each window slides forward one message in time to form a time series feature vector.

[0215] S3: constructing a nonlinear state space model based on the time series feature vector, wherein the nonlinear state space model includes a state equation and a measurement equation;

[0216] In a specific embodiment, the state equation and the measurement equation are expressed as:

[0217]

[0218] Among them, x k ∈R n is the system state variable; z k ∈R m is the observed variable (extracted from the CAN message); f(·) and h(·) are the nonlinear state transfer function and measurement function; Q k and R k are the process noise covariance matrix and the measurement noise covariance matrix respectively.

[0219] S4: performing unscented Kalman filter state prediction based on the nonlinear state space model;

[0220] In a specific embodiment, the method for performing unscented Kalman filter state prediction based on the nonlinear state space model includes:

[0221] Based on the state estimate and state covariance matrix at the previous moment, the Sigma point set is generated using the Unscented Transform (UT);

[0222] Through the state transfer equation, the Sigma point set is propagated to calculate the state prediction value and prediction covariance matrix at the current moment;

[0223] Based on the measurement equation, the projection of the Sigma point in the measurement space is calculated to obtain the measurement prediction value and the measurement covariance matrix.

[0224] In a specific embodiment, a method for generating a Sigma point set using an unscented transformation based on a state estimate and a state covariance matrix at a previous moment includes:

[0225] The state dimension is n, and the parameters α, β, and κ are selected to calculate the scaling factor:

[0226]

[0227] Generate 2n+1 Sigma points:

[0228]

[0229] in, is the predicted value of the i-th Sigma point at the k-th moment, is the predicted state value of the i-th Sigma point at the k-th moment, P k-1 is the state covariance matrix of the previous moment, is the scaling factor, where λ = α 2 (n+κ)-n, The i-th column vector of the square root of the matrix;

[0230] The method of propagating the Sigma point set through the state transfer equation and calculating the state prediction value and prediction covariance matrix at the current moment includes:

[0231] Propagate each Sigma point through the state transfer function to obtain the current moment:

[0232]

[0233] in, Sigma point The propagation result after passing through the state transfer function f(·), f(·) is the system state transfer function, which describes how the system state evolves from the previous moment to the current moment;

[0234] Predicted state mean:

[0235]

[0236] in, is the predicted state mean at the current moment, is the weighted mean coefficient of the i-th Sigma point, satisfying is the i-th Sigma point after state propagation;

[0237] Forecast covariance matrix:

[0238]

[0239] in, is the current moment predicted state covariance matrix, is the covariance weight of the i-th Sigma point, is the predicted state mean, Q k is the process noise covariance matrix at the current moment, is the i-th Sigma point after state propagation prediction;

[0240] Based on the measurement equation, the method of calculating the projection of the Sigma point in the measurement space and obtaining the measurement prediction value and the measurement covariance matrix includes:

[0241] Map the Sigma point to the observation space:

[0242]

[0243] in, is the mapping value of the i-th Sigma point in the observation space; is the predicted value of the i-th Sigma point propagated to the k-th moment in the state space, h(·) is the system measurement function, which is used to map the state variables to observable quantities;

[0244] Compute the predicted observations and the measured covariance:

[0245]

[0246] in, is the predicted observation value at the kth moment, is the weighted mean of the observations of the i-th Sigma point; is the mapping result of the i-th Sigma point in the observation space, n is the state dimension, and the number of Sigma points is 2n+1;

[0247]

[0248] Among them, S k is the observation-forecast covariance matrix at the kth moment, is the covariance weight of the i-th Sigma point, is the Sigma point in the i-th observation space, is the predicted observation mean, R k is the measurement noise covariance matrix, which reflects the sensor error or system measurement uncertainty.

[0249] S5: Input the time series feature vector as the actual observation value, calculate the Kalman gain to correct the unscented Kalman filter state prediction result, and output the state estimation residual;

[0250] In a specific embodiment, the method of inputting the time series feature vector as the actual observation value, calculating the Kalman gain to correct the unscented Kalman filter state prediction result, and outputting the state estimation residual includes:

[0251] Compute the state-observation cross-covariance matrix:

[0252]

[0253] Among them, P xz is the cross-covariance matrix between states and observations, is the predicted value of the i-th Sigma point in the state space, is the mapping result of the i-th Sigma point in the observation space, is the predicted state mean, is the predicted observation mean;

[0254] Calculate the Kalman gain and update the state and covariance:

[0255]

[0256] Among them, K k is the Kalman gain matrix at the kth moment, P xz is the cross-covariance matrix between states and observations, is the inverse of the measurement covariance matrix, used for weighted updates, is the updated estimated value of the system state, is the prediction residual (innovation term), P k is the updated state covariance matrix, is the predicted state covariance, S k is the predicted observation covariance matrix.

[0257] S6: Based on the state estimation residual, dynamically update the process noise covariance matrix by exponentially weighted moving average, and adjust the measurement noise covariance matrix according to the measurement innovation sequence;

[0258] In a specific embodiment, based on the state estimation residual, dynamically updating the process noise covariance matrix by exponentially weighted moving average (EWMA), and adjusting the measurement noise covariance matrix according to the measurement innovation sequence includes:

[0259] Based on the state estimation residual The process noise covariance matrix Q k and the measurement noise covariance matrix R k Perform adaptive updates:

[0260]

[0261] Among them, α, β∈(0,1) are smoothing factors.

[0262] S7: Calculate the Mahalanobis distance of the state estimation residual, compare it with the adaptive anomaly detection threshold, and determine whether an intrusion behavior occurs;

[0263] In a specific embodiment, the method of calculating the Mahalanobis distance of the state estimation residual and comparing it with the adaptive anomaly detection threshold to determine whether an intrusion behavior has occurred includes:

[0264] Calculate the anomaly score:

[0265] The Mahalanobis distance is used to measure the strength of the deviation between the observation and the prediction:

[0266]

[0267] in, is the prediction residual at the kth moment; is the current prediction measurement covariance matrix; S anomaly is the abnormal score value at the current moment; where m represents the observation vector z k The dimension is the measurement features extracted from the CAN message at each moment;

[0268] This score measures the statistical consistency between the current observation and the prediction. If the system is operating normally, y k = has a mean of zero and a covariance of s k Gaussian distribution, so s anomaly Approximately follows a chi-square distribution with m degrees of freedom:

[0269] S anomaly ~χ 2 (m)

[0270] Make an exception judgment:

[0271] Setting the significance level δ, we can look up the table to obtain the critical value τ, so that:

[0272] P(S anomaly >τ)=δ

[0273] The exception judgment rule is:

[0274] S anomaly >τ

[0275] If it is abnormal, it will enter the alarm process; otherwise, it is considered that the current state is within the normal range.

[0276] S8: If the anomaly score exceeds the threshold, a multi-level alarm mechanism is triggered, suspicious messages are recorded, and security protection operations are performed;

[0277] Specifically, if the anomaly score is lower than the adaptive threshold, it is judged as normal communication and state estimation continues; if the anomaly score exceeds the threshold, it is judged that the CAN bus may be invaded and the alarm mechanism is triggered; after the anomaly alarm is triggered, the current suspicious CAN message is recorded and stored in the security log database.

[0278] The alarm mechanism includes:

[0279] The system immediately sends an alarm signal to the vehicle control system, such as a buzzer, visual prompt, or performs actions such as CAN link isolation.

[0280] The log records include:

[0281] Record the current time, anomaly score, prediction residual, original message and other information to form an abnormal event log package for subsequent tracing or attack classification analysis.

[0282] The present invention is based on an adaptive unscented Kalman filter and integrates state estimation theory, statistical detection methods and an online covariance adjustment mechanism. It has the advantages of closed-loop structure, real-time response and model adaptation, and is suitable for high-precision detection of intrusion behaviors in modern vehicle-mounted CAN communication environments.

[0283] Obviously, the above embodiments of the present invention are merely examples for the purpose of clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. Those skilled in the art will appreciate that other variations or modifications can be made based on the above description. It is not necessary and impossible to enumerate all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the claims of the present invention.

Claims

1. A CAN bus intrusion detection method based on adaptive unscented Kalman filtering, characterized in that: The method comprises the following steps: Get real-time message data of CAN bus communication; Preprocessing the real-time message data to obtain a time series feature vector; constructing a nonlinear state space model based on the time series feature vector, wherein the nonlinear state space model includes a state equation and a measurement equation; Performing unscented Kalman filter state prediction based on the nonlinear state space model; The time series feature vector is input as the actual observation value, the Kalman gain is calculated to correct the unscented Kalman filter state prediction result, and the state estimation residual is output; Based on the state estimation residual, dynamically updating the process noise covariance matrix by exponentially weighted moving average, and adjusting the measurement noise covariance matrix according to the measurement innovation sequence; Calculating the Mahalanobis distance of the state estimation residual and comparing it with the adaptive anomaly detection threshold to determine whether an intrusion occurs; If the anomaly score exceeds the threshold, a multi-level alarm mechanism is triggered, suspicious messages are recorded, and security protection operations are performed.

2. The CAN bus intrusion detection method based on adaptive unscented Kalman filtering according to claim 1 is characterized in that: The method of preprocessing the real-time message data to obtain a time series feature vector includes: Extracting communication features of the real-time message data, the communication features including a message identifier, a data length code, a data field, and a message time interval; Normalize communication features of different dimensions; The sliding window method is used to construct the time series feature vector.

3. The CAN bus intrusion detection method based on adaptive unscented Kalman filtering according to claim 2 is characterized in that: The method for extracting the communication characteristics of the real-time message data includes: Let the i-th message be x i , contains the following fields: x i ={ID i ,DLC i ,DATA i ,T i } Among them, ID i is the message identifier, DLC i is the data length code, is the data field byte vector, T i is the timestamp; Methods for normalizing communication features of different dimensions include: The communication characteristics of each CAN message are standardized using the minimum-maximum normalization method; Assume that the original communication characteristics of the i-th CAN message are: Where d is the characteristic dimension of each message, and the normalization formula is: in, is the minimum value of each dimension feature in historical data; is the maximum value of each dimension feature in the historical data; the operation is element-by-element normalization, that is, for each dimension j: Normalized vector All characteristic information of each message is retained and used as state variable input in the subsequent state space model; Methods for constructing time series feature vectors using the sliding window method include: A fixed-length sliding window mechanism is used to perform temporal combination of continuous normalized messages to construct a state vector input sequence; Assume that the sliding window length is W, that is, the system state at each moment is composed of the previous W consecutive messages; then the state input vector constructed at time k is expressed as: in, represents the normalized feature vector of the tth message; x k It is the state vector after the sliding window is expanded, with W×d dimensions; each window slides forward one message in time to form a time series feature vector.

4. The CAN bus intrusion detection method based on adaptive unscented Kalman filtering according to claim 1 is characterized in that: The expressions of the state equation and the measurement equation are: Among them, x k ∈R n is the system state variable; z k ∈R m is the observed variable; f(·) and h(·) are the nonlinear state transfer function and measurement function; Q k and R k are the process noise covariance matrix and the measurement noise covariance matrix respectively.

5. The CAN bus intrusion detection method based on adaptive unscented Kalman filtering according to claim 4 is characterized in that: The system state variables include the sending frequency characteristics, data load change characteristics and time interval characteristics of the CAN message.

6. The CAN bus intrusion detection method based on adaptive unscented Kalman filtering according to claim 1 is characterized in that: The method for performing unscented Kalman filter state prediction based on the nonlinear state space model includes: Based on the state estimate and state covariance matrix at the previous moment, the Sigma point set is generated using unscented transformation; Through the state transfer equation, the Sigma point set is propagated to calculate the state prediction value and prediction covariance matrix at the current moment; Based on the measurement equation, the projection of the Sigma point in the measurement space is calculated to obtain the measurement prediction value and the measurement covariance matrix.

7. The CAN bus intrusion detection method based on adaptive unscented Kalman filtering according to claim 6 is characterized in that: Based on the state estimate and state covariance matrix at the previous moment, the method of generating the Sigma point set by unscented transformation includes: The state dimension is n, and the parameters α, β, and κ are selected to calculate the scaling factor: Generate 2n+1 Sigma points: in, is the predicted value of the i-th Sigma point at the k-th moment, is the predicted state value of the i-th Sigma point at the k-th moment, P k-1 is the state covariance matrix of the previous moment, is the scaling factor, where λ = α 2 (n+κ)-n, The i-th column vector of the square root of the matrix; The method of propagating the Sigma point set through the state transfer equation and calculating the state prediction value and prediction covariance matrix at the current moment includes: Propagate each Sigma point through the state transfer function to obtain the current moment: in, Sigma point The propagation result after passing through the state transfer function f(·), f(·) is the system state transfer function, which describes how the system state evolves from the previous moment to the current moment; Predicted state mean: in, is the predicted state mean at the current moment, is the weighted mean coefficient of the i-th Sigma point, satisfying is the i-th Sigma point after state propagation; Forecast covariance matrix: in, is the current moment predicted state covariance matrix, is the covariance weight of the i-th Sigma point, is the predicted state mean, Q k is the process noise covariance matrix at the current moment, is the i-th Sigma point after state propagation prediction; Based on the measurement equation, the method of calculating the projection of the Sigma point in the measurement space and obtaining the measurement prediction value and the measurement covariance matrix includes: Map the Sigma point to the observation space: in, is the mapping value of the i-th Sigma point in the observation space; is the predicted value of the i-th Sigma point propagated to the k-th moment in the state space, h(·) is the system measurement function, which is used to map the state variables to observable quantities; Compute the predicted observations and the measured covariance: in, is the predicted observation value at the kth moment, is the weighted mean of the observations of the i-th Sigma point; is the mapping result of the i-th Sigma point in the observation space, n is the state dimension, and the number of Sigma points is 2n+1; Among them, S k is the observation-forecast covariance matrix at the kth moment, is the covariance weight of the i-th Sigma point, is the Sigma point in the i-th observation space, is the predicted observation mean, R k is the measurement noise covariance matrix, which reflects the sensor error or system measurement uncertainty.

8. The CAN bus intrusion detection method based on adaptive unscented Kalman filtering according to claim 1 is characterized in that: The method of inputting the time series feature vector as an actual observation value, calculating the Kalman gain to correct the unscented Kalman filter state prediction result, and outputting the state estimation residual includes: Compute the state-observation cross-covariance matrix: Among them, P xz is the cross-covariance matrix between states and observations, is the predicted value of the i-th Sigma point in the state space, is the mapping result of the i-th Sigma point in the observation space, is the predicted state mean, is the predicted observation mean; Calculate the Kalman gain and update the state and covariance: Among them, K k is the Kalman gain matrix at the kth moment, P xz is the cross-covariance matrix between states and observations, is the inverse of the measurement covariance matrix, used for weighted updates, is the updated estimated value of the system state, is the prediction residual (innovation term), P k is the updated state covariance matrix, is the predicted state covariance, S k is the predicted observation covariance matrix.

9. The CAN bus intrusion detection method based on adaptive unscented Kalman filtering according to claim 8 is characterized in that: The method of dynamically updating the process noise covariance matrix by exponentially weighted moving average based on the state estimation residual and adjusting the measurement noise covariance matrix according to the measurement innovation sequence includes: Based on the state estimation residual The process noise covariance matrix Q k and the measurement noise covariance matrix R k Perform adaptive updates: Among them, α, β∈(0,1) are smoothing factors.

10. The CAN bus intrusion detection method based on adaptive unscented Kalman filtering according to claim 1 is characterized in that: The method of calculating the Mahalanobis distance of the state estimation residual and comparing it with the adaptive anomaly detection threshold to determine whether an intrusion behavior has occurred includes: Calculate the anomaly score: The Mahalanobis distance is used to measure the strength of the deviation between the observation and the prediction: in, is the prediction residual at the kth moment; is the current prediction measurement covariance matrix; S anomaly is the abnormal score value at the current moment; where m represents the observation vector z k The dimension is the measurement features extracted from the CAN message at each moment; This score measures the statistical consistency between the current observation and the prediction. If the system is operating normally, y k = has a mean of zero and a covariance of S k Gaussian distribution, so S anomaly Approximately follows a chi-square distribution with m degrees of freedom: S anomaly ~χ 2 (m) Make an exception judgment: Setting the significance level δ, we can look up the table to obtain the critical value τ, so that: P(S anomaly >t)=d The exception judgment rule is: S anomaly >t If it is abnormal, it will enter the alarm process; otherwise, it is considered that the current state is within the normal range.

Images