CAN bus intrusion detection method and device and computer readable storage medium

Abstract

The invention discloses a CAN bus intrusion detection method and device and a computer readable storage medium. The CAN bus intrusion detection method comprises the steps that first preprocessing is carried out on CAN bus data, a first feature map related to a CAN message identifier is generated, and the column number of the first feature map is the same as the binary bit number of an extension frame of the CAN message identifier; processing the first feature map through a feature matching intrusion detection model, and determining the intrusion category of the CAN bus data; second preprocessing is carried out on the CAN bus data to generate a second feature map, and the second feature map comprises a timestamp, a CAN message identifier, a data byte number, a data field and a label; and judging whether the CAN bus data is intrusion information or not according to the second feature map through an abnormal statistical intrusion detection model.

Description

TECHNICAL FIELD

[0001] The present application relates to the Internet of Vehicles automobile safety detection technical field, in particular to a CAN bus intrusion detection method and device and a computer readable storage medium. BACKGROUND

[0002] With the closer cooperation between the traditional automobile industry and Internet companies, intelligent networked cars have emerged. Since intelligent networked cars usually use CAN protocol and are equipped with a large number of electronic devices (such as electronic control, media systems, intelligent auxiliary driving systems and communication entertainment systems, etc.), hackers can connect to the CAN network in the car by attacking these auxiliary systems, and then intrude into the core control system of the car and take control of the car.

[0003] At the same time, since the CAN protocol does not perform encryption and authentication, and there is no source address and destination address in the CAN message, any ECU node connected to the CAN bus can obtain the message during message transmission. Therefore, the CAN bus is extremely vulnerable to attackers, and thus intrudes into the intelligent networked car. Moreover, due to the real-time requirements of intelligent networked cars for data, if an authentication or encryption mechanism is added to the CAN protocol, the performance of the car's intelligent system will be reduced, thereby affecting driving safety.

[0004] Therefore, the current common method is to use the intrusion detection technology of the vehicle CAN bus to realize intrusion protection of the vehicle CAN bus through timely alarm and response to intrusion behavior, and to ensure the safety and controllability of the vehicle. However, the existing vehicle intrusion detection system mainly has two problems: one is that it cannot detect known attacks and unknown attacks at the same time; the other is that the model is generally large and the reasoning time is long, which does not meet the real-time requirements of the vehicle.

[0005] In view of the technical problems in the prior art that the existing vehicle intrusion detection system cannot detect known attacks and unknown attacks at the same time, and the model set is generally large and the reasoning time is long, which does not meet the real-time requirements of the vehicle, no effective solution has been proposed so far. SUMMARY

[0006] The embodiments of the present application provide a CAN bus intrusion detection method, device and computer readable storage medium to at least solve the technical problems in the prior art that the existing vehicle intrusion detection system cannot detect known attacks and unknown attacks at the same time, and the model set is generally large and the reasoning time is long, which does not meet the real-time requirements of the vehicle.

[0007] According to an aspect of the embodiments of the present application, a CAN bus intrusion detection method is provided, including: performing first preprocessing on CAN bus data to generate a first feature map related to a CAN message identifier, wherein the number of columns of the first feature map is the same as the number of binary bits of an extended frame of the CAN message identifier; processing the first feature map through a feature matching intrusion detection model to determine an intrusion category of the CAN bus data; and in a case where the CAN bus data is determined to be normal according to the intrusion category, performing intrusion detection on the CAN bus data through an anomaly statistical intrusion detection model based on zero-sample anomaly detection. The operation of processing the first feature map through the feature matching intrusion detection model to determine the intrusion category of the CAN bus data includes: performing encoding processing on the first feature map through an encoder provided with a residual block with a predetermined number of channels to generate first feature information; performing feature extraction on the first feature information through a mapping network to generate second feature information; and classifying the second feature information through a classifier to determine the intrusion category of the CAN bus data.

[0008] According to another aspect of the embodiments of the present application, a CAN bus intrusion detection device is also provided, including: a first preprocessing module configured to perform first preprocessing on CAN bus data to generate a first feature map related to a CAN message identifier, wherein the number of columns of the first feature map is the same as the number of binary bits of an extended frame of the CAN message identifier; a feature matching intrusion detection module configured to process the first feature map through a feature matching intrusion detection model to determine an intrusion category of the CAN bus data; and an anomaly statistical intrusion detection module configured to, in a case where the CAN bus data is determined to be normal according to the intrusion category, perform intrusion detection on the CAN bus data through an anomaly statistical intrusion detection model based on zero-sample anomaly detection. The category determination module includes: a first generation submodule configured to perform encoding processing on the first feature map through an encoder provided with a residual block with a predetermined number of channels to generate first feature information; a second generation submodule configured to perform feature extraction on the first feature information through a mapping network to generate second feature information; and a category determination submodule configured to classify the second feature information through a classifier to determine the intrusion category of the CAN bus data.

[0009] According to another aspect of the embodiments of the present application, a CAN bus intrusion detection device is also provided, comprising: a processor; and a memory connected with the processor, configured to provide the processor with instructions to process the following steps: performing first preprocessing on CAN bus data to generate a first feature map related to a CAN message identifier, wherein the number of columns of the first feature map is the same as the number of binary bits of an extended frame of the CAN message identifier; processing the first feature map through a feature matching intrusion detection model to determine an intrusion category of the CAN bus data; and in a case where it is determined according to the intrusion category that the CAN bus data is normal, performing intrusion detection on the CAN bus data through an anomaly statistical intrusion detection model based on zero sample anomaly detection, wherein the operation of processing the first feature map through the feature matching intrusion detection model to determine the intrusion category of the CAN bus data comprises: performing encoding processing on the first feature map through an encoder provided with a residual block with a predetermined number of channels to generate first feature information; performing feature extraction on the first feature information through a mapping network to generate second feature information; and classifying the second feature information through a classifier to determine the intrusion category of the CAN bus data.

[0010] According to another aspect of the embodiments of the present application, a computer readable storage medium having a computer program stored thereon is also provided, and the computer program is executed by a processor to implement the steps of the above method.

[0011] In the embodiments of the present application, the feature matching intrusion detection model is used to detect known attacks according to the CAN bus data, and the anomaly statistical intrusion detection model is used to detect unknown attacks, so that the technical solution can comprehensively detect intrusion attacks by using the feature matching intrusion detection model and the anomaly statistical intrusion detection model. Furthermore, the feature map of m*29 is constructed in the technical solution, compared with the existing input data of 512*512 grayscale image, the technical solution reduces the elements in the feature map, thereby reducing the processing time when the feature matching intrusion detection model processes the feature map, and improving the operation efficiency. Furthermore, the encoder of the feature matching intrusion detection model in the technical solution is a compact resnet-18, compared with the traditional resnet-18, the encoder of the compact resnet-18 in the technical solution reduces the number of convolutional layer channels, and simplifies the redundant channel number, so that the feature matching intrusion detection model is greatly reduced, and the data operation of the feature matching intrusion detection model is reduced, the operation speed of the feature matching intrusion detection model is improved, and the real-time requirement of intrusion detection is ensured. Furthermore, the technical problem that the existing vehicle intrusion detection system cannot detect known attacks and unknown attacks at the same time, and the model set is generally large and the inference time is long, which does not meet the real-time requirement of the vehicle, is solved. BRIEF DESCRIPTION OF DRAWINGS

[0012] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:

[0013] Figure 1 is a hardware structure block diagram of a computing device for implementing the method according to Embodiment 1 of the application;

[0014] Figure 2 is a schematic diagram of a CAN bus intrusion detection system according to Embodiment 1 of the application;

[0015] Figure 3 is a flowchart of a CAN bus intrusion detection method according to the first aspect of Embodiment 1 of the application;

[0016] Figure 4 is a schematic diagram of a feature matching intrusion detection model according to the first aspect of Embodiment 1 of the application;

[0017] Figure 5 is a schematic diagram of an encoder according to the first aspect of Embodiment 1 of the application;

[0018] Figure 6 is a schematic diagram of an anomaly statistical intrusion detection model according to the first aspect of Embodiment 1 of the application;

[0019] Figure 7 is a batch size comparison diagram according to the first aspect of Embodiment 1 of the application;

[0020] Figure 8 is a learning rate comparison diagram according to the first aspect of Embodiment 1 of the application;

[0021] Figure 9 is a schematic diagram of a feature matching intrusion detection model test result according to the first aspect of Embodiment 1 of the application;

[0022] Figure 10 is a schematic diagram of a confusion matrix according to the first aspect of Embodiment 1 of the application;

[0023] Figure 11 is a schematic diagram of a CAN bus intrusion detection device according to Embodiment 2 of the application; and

[0024] Figure 12 is a schematic diagram of a CAN bus intrusion detection device according to Embodiment 3 of the application. DETAILED DESCRIPTION

[0025] To enable those skilled in the art to better understand the technical solutions of this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] Example 1

[0028] According to this embodiment, a method embodiment of a CAN bus intrusion detection method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Also, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0029] The method embodiments provided in this example can be executed on mobile terminals, computer terminals, servers, or similar computing devices. Figure 1 A hardware block diagram of a computing device for implementing a CAN bus intrusion detection method is shown. Figure 1 As shown, a computing device may include one or more processors (processors may include, but are not limited to, microprocessors such as MCUs or programmable logic devices such as FPGAs), memory for storing data, and transmission devices for communication functions. In addition, it may also include: a display, input / output interfaces (I / O interfaces), a universal serial bus (USB) port (which may be included as one of the ports in the I / O interface), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, a computing device may also include... Figure 1more or less components than those shown, or in configurations with different configurations of Figure 1

[0030] It should be noted that the one or more processors and / or other data processing circuitry described above can be generally referred to herein as "data processing circuitry." The data processing circuitry can be embodied in whole or in part as software, hardware, firmware, or any combination thereof. In addition, the data processing circuitry can be a single standalone processing module, or incorporated in whole or in part within any one of other elements of the computing device. As referred to in embodiments of the present application, the data processing circuitry serves as a processor to control, for example, the selection of the variable resistance terminal path connected to the interface.

[0031] The memory can be used to store software programs of application software and modules, such as the program instructions / data storage means corresponding to the CAN bus intrusion detection method in embodiments of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, i.e., implements the CAN bus intrusion detection method of the application program described above. The memory can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory can further include a memory remotely arranged with respect to the processor, which can be connected to the computing device through a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0032] The transmission device is used to receive or send data via a network. Specific examples of the above-mentioned network can include a wireless network provided by a communication provider of the computing device. In one example, the transmission device includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to be able to communicate with the Internet. In one example, the transmission device can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet in a wireless manner.

[0033] The display can be, for example, a touch screen type liquid crystal display (LCD), which can enable a user to interact with the user interface of the computing device.

[0034] It should be noted that in some optional embodiments, the above-mentioned Figure 1 The computing device shown above can include hardware elements (including circuitry), software elements (including computer code stored on a computer readable medium), or a combination of both hardware and software elements. It should be noted that in some embodiments, the functions of the above-mentioned Figure 1 ​This is only one instance of a specific particular instance, and is intended to illustrate the types of components that may exist in the aforementioned computing devices.

[0035] Figure 2 This is a schematic diagram of an intrusion detection system for a CAN bus according to this embodiment. (Refer to...) Figure 2 As shown, the system is connected to the vehicle terminal 100 and includes: a data processing module 210, a detection module 220, and a training module 230.

[0036] The data processing module 210 processes CAN bus data and sends the processed CAN bus data to the detection module 220 for detection, or sends it as a sample to the training module 230 for model training.

[0037] The detection module 220 is used to detect whether the CAN bus data processed by the data processing module is intrusive data.

[0038] The training module 230 is used to train the model based on the CAN bus data processed by the data processing module.

[0039] Under the aforementioned operating environment, according to the first aspect of this embodiment, a CAN bus intrusion detection method is provided, the method comprising: Figure 2 The intrusion detection system implementation for the CAN bus shown is illustrated. Figure 3 A flowchart illustrating the method is shown below. (Refer to...) Figure 3 As shown, the method includes:

[0040] S302: Perform first preprocessing on the CAN bus data to generate a first feature map related to the CAN message identifier, wherein the number of columns in the first feature map is the same as the number of binary bits in the extended frame of the CAN message identifier;

[0041] S304: The first feature map is processed using a feature-matching intrusion detection model to determine the intrusion category of the CAN bus data; and

[0042] S306: When the CAN bus data is determined to be normal based on the intrusion category, an intrusion detection model based on zero-sample anomaly detection is used to determine whether the CAN bus data is subject to intrusion detection. The operation of the feature matching intrusion detection model to process the first feature map and determine the intrusion category of the CAN bus data includes: encoding the first feature map by an encoder with a predetermined number of residual blocks to generate first feature information; extracting features from the first feature information through a mapping network to generate second feature information; and classifying the second feature information by a classifier to determine the intrusion category of the CAN bus data.

[0043] Specifically, the data processing module 210 receives a plurality of CAN bus data, wherein the plurality of CAN bus data are a plurality of message data continuously transmitted, including data frames, remote frames, error frames, overload frames, and frame intervals, and the like, wherein the data frames include a data field of actual data transmitted and a CAN message identifier (CAN ID), the remote frames are used to trigger other nodes to transmit data, the error frames and the overload frames are used for communication exception processing, and the frame intervals are used for logical segmentation of messages. Then the data processing module 210 obtains the CAN message identifiers of the plurality of CAN bus data. The CAN message identifier is a hexadecimal number. The data processing module 210 pre-processes (i.e., first preprocessing) the CAN message identifier, thereby converting the CAN message identifier from a hexadecimal number to a binary number to generate a binary CAN message identifier. The extension frame of the CAN message identifier in hexadecimal is at most 18 digits, and when converted from hexadecimal to binary, the binary number is at most 29 digits, so in this embodiment, the binary number corresponding to the CAN message identifier is set to 29 digits. And the data processing module 210 splices the binary CAN message identifiers of a predetermined number (for example, m) of CAN bus data, thereby generating a binary image (i.e., a first feature map) of m*29 [A] = [Fa1, Fa2, …, Fam]. m ] T Then the data processing module 210 sends the first feature map [A] to the detection module 220.

[0044] wherein Fa v represents the vth binary message identifier, v = 1 ~ m. And wherein:

[0045] Fa1 = [fa 1,1 , fa 2,1 , …, fa 29,1 ];

[0046] Fa2 = [fa 1,2 , fa 2,2 , …, fa 29,2 ];

[0047] …

[0048] Fa m = [fa 1,m , fa 2,m , …, fa 29,m ].

[0049] wherein fa u,v represents the uth digit of the vth binary message identifier, u = 1 ~ 29.

[0050] Preferably, m = 29, so that the binary image (i.e., the first feature map) generated by the data processing module 210 is a 29*29 binary image (i.e., the first feature map) [A] = [Fa1, Fa2,..., Fa 29 T .

[0051] Further, the detection module 220 is pre-provided with a feature matching intrusion detection model. Then the detection module 220 inputs the first feature map [A] sent by the data processing module 210 into the feature matching intrusion detection model, processes the first feature map [A] through the feature matching intrusion detection model, and outputs the intrusion category of the CAN bus data corresponding to the first feature map [A]. Wherein the intrusion category includes normal, Dos, Fuzzy and Spoofing. Wherein normal means that the feature matching intrusion detection model determines that the CAN bus data corresponding to the first feature map [A] is normal data, and has no attack and intrusion nature. Dos, Fuzzy and Spoofing represent three types of attacks and intrusions.

[0052] More specifically, referring to FIG. 2, the feature matching intrusion detection model includes an encoder, a mapping network and a classifier. Figure 4

[0053] The feature matching intrusion detection model inputs the received first feature map [A] into the encoder, wherein the encoder is a compact Resnet-18. Wherein the compact Resnet-18 is provided with a plurality of residual blocks, and wherein the channel number of the convolutional layer in the first two residual blocks is set to 16. It should be noted that the channel number of the convolutional layer in the first two residual blocks in the traditional Resnet-18 is 64, and in this embodiment, the 64 channel number of the convolutional layer is improved to 16, which reduces the redundant channels on the basis of normal operation.

[0054] Thus, the encoder encodes and processes the first feature map to output first feature information. Then the feature matching intrusion detection model inputs the first feature information into the mapping network, extracts the first feature information through the mapping network to generate second feature information. Wherein the mapping network is a fully connected layer. Then the feature matching intrusion detection model inputs the second feature information into the classifier, classifies the second feature information through the classifier, and determines the intrusion category of the CAN bus data.

[0055] ​​In a case where the detection module 220 determines that the CAN bus data is normal data by using the feature matching intrusion detection model, the data processing module 210 performs data preprocessing on the CAN bus data by using a sliding window, and inputs third feature information corresponding to the sliding window obtained by preprocessing into an anomaly statistical intrusion detection model based on zero-sample anomaly detection. Whether the CAN bus data contains intrusion information is determined by the anomaly statistical intrusion detection model according to the third feature information. Further information about the anomaly statistical intrusion detection model will be described in detail below.

[0056] As described in the background, the vehicle CAN bus intrusion detection system only listens to CAN bus data and gives a warning when an attack occurs, which is an important means of security protection for a controller area network. The existing vehicle intrusion detection system mainly has two problems: one is that it cannot detect known attacks and unknown attacks at the same time; and the other is that the model is generally large and the reasoning time is long, which does not meet the real-time requirements of vehicles.

[0057] To solve the above technical problems, the technical scheme of the embodiment of the present application detects known attacks by using a feature matching intrusion detection model according to CAN bus data, and detects unknown attacks by using an anomaly statistical intrusion detection model, so that the technical scheme can comprehensively detect intrusion attacks by using the feature matching intrusion detection model and the anomaly statistical intrusion detection model. Furthermore, the technical scheme constructs a feature map of m*29, which is compared with the existing technology in which the input data is a 512*512 grayscale image. The technical scheme reduces the elements in the feature map, thereby reducing the processing time when the feature matching intrusion detection model processes the feature map and improving the operation efficiency. Furthermore, the encoder in the feature matching intrusion detection model in the technical scheme is a compact resnet-18, which reduces the number of convolution layers compared with the traditional resnet-18. The technical scheme simplifies the redundant channel number, greatly reduces the feature matching intrusion detection model, and reduces the data operation of the feature matching intrusion detection model, thereby improving the operation speed of the feature matching intrusion detection model and ensuring the real-time requirements of intrusion detection. Furthermore, the technical scheme solves the technical problems in the prior art that the existing vehicle intrusion detection system cannot detect known attacks and unknown attacks at the same time, and the model is generally large and the reasoning time is long, which does not meet the real-time requirements of vehicles.

[0058] Optionally, the operation of encoding the first feature map by the encoder provided with the residual blocks with the predetermined number of channel numbers to generate the first feature information comprises: performing convolution operation on the first feature map by a first convolution layer of the encoder to generate a third feature map; performing processing on the third feature map by a plurality of residual blocks of the encoder to generate a fourth feature map; and performing processing on the fourth feature map by an average pooling layer of the encoder to generate the first feature information, wherein the operation of performing processing on the third feature map by the plurality of residual blocks of the encoder to generate the fourth feature map comprises: performing convolution operation on the third feature map by a second convolution layer provided with the predetermined number of channel numbers of a first residual block to generate a fifth feature map; performing residual connection on the third feature map and the fifth feature map to generate a sixth feature map; performing convolution operation on the sixth feature map by a third convolution layer provided with the predetermined number of channel numbers of a second residual block to generate a seventh feature map; performing residual connection on the sixth feature map and the seventh feature map to generate an eighth feature map; and performing processing on the eighth feature map by a plurality of third residual blocks to generate the fourth feature map.

[0059] In detail, referring to FIG. 1, Figure 5 The encoder comprises a first convolution layer, residual blocks 1 to L, and an average pooling layer.

[0060] The encoder inputs the received first feature map into the first convolution layer, wherein the first convolution layer is provided with a convolution kernel of 3*3 and a channel number of 16. Thus, the first convolution layer performs convolution operation on the first feature map to generate a third feature map. Then, the encoder inputs the third feature map into the residual block 1. The residual block 1 is provided with two convolution layers (i.e., second convolution layers), which are convolution layers c1 and c2, respectively. The convolution layers c1 and c2 (i.e., the second convolution layers) are both provided with a convolution kernel of 3*3 and a channel number of a predetermined number, for example, 16. Thus, the convolution layer c1 of the residual block 1 performs convolution operation on the third feature map to output a corresponding feature map. Then, the residual block 1 performs convolution operation on the feature map output by the convolution layer c1 by the convolution layer c2 to output a fifth feature map.

[0061] Further, the encoder performs residual connection on the third feature map and the fifth feature map, thereby performing element-wise addition on the third feature map and the fifth feature map to generate a sixth feature map. Then, the encoder inputs the sixth feature map into the residual block 2. The residual block 2 is provided with two convolution layers (i.e., third convolution layers), which are convolution layers c3 and c4, respectively. The convolution layers c3 and c4 (i.e., the third convolution layers) are both provided with a convolution kernel of 3*3 and a channel number of a predetermined number, for example, 16. Thus, the convolution layer c3 of the residual block 2 performs convolution operation on the sixth feature map to output a corresponding feature map. Then, the residual block 2 performs convolution operation on the feature map output by the convolution layer c3 by the convolution layer c4 to output a seventh feature map.

[0062] Further, the encoder performs residual connection between the sixth feature map and the seventh feature map, thereby performing element-by-element addition between the sixth feature map and the fifth feature map to generate an eighth feature map. Then the encoder inputs the eighth feature map into a residual block 3 (i.e., a third residual block). The residual block 3 is provided with two convolution layers, which are convolution layers c5 and c6. The convolution layers c5 and c6 are both provided with a convolution kernel of 3*3 and a channel number of 32. Thus, the convolution layer c5 performs convolution layer operation on the eighth feature map to output a corresponding feature map. Then the residual block 3 performs convolution operation on the feature map output by the convolution layer c5 through the convolution layer c6 to output a ninth feature map.

[0063] Further, the encoder performs residual connection between the eighth feature map and the ninth feature map, thereby performing element-by-element addition between the eighth feature map and the ninth feature map to generate a tenth feature map. Then the encoder inputs the tenth feature map into a residual block 4 (i.e., a third residual block). The residual block 4 is provided with two convolution layers, which are convolution layers c7 and c8. The convolution layers c7 and c8 are both provided with a convolution kernel of 3*3 and a channel number of 32. Thus, the convolution layer c7 performs convolution layer operation on the eleventh feature map to output a corresponding feature map. Then the residual block 4 performs convolution operation on the feature map output by the convolution layer c7 through the convolution layer c8 to output a twelfth feature map.

[0064] By analogy, the encoder performs convolution operation on the input feature map through the two convolution layers (e.g., c9 and c10) of the residual block L to output a corresponding feature map. And the encoder performs residual connection between the feature map output by the residual block L and the input feature map to generate a fourth feature map.

[0065] Preferably, L=8, and the encoder includes the residual block 1 to the residual block 8. Thus, the encoder performs convolution operation on the input feature map through the two convolution layers of the residual block 8 to output a corresponding feature map. The convolution layers of the residual block 8 are both provided with a convolution kernel of 3*3 and a channel number of 128. Then the encoder performs residual connection between the feature map output by the residual block 8 and the input feature map to generate a fourth feature map.

[0066] Further, the encoder inputs the fourth feature map into an average pooling layer, processes the fourth feature map through the average pooling layer to generate first feature information.

[0067] The channel number of the convolution layer of the residual block of the traditional resnet-18 is 64. The inventors have found through experiments that three fourths of the convolution layer channels are redundant channels. Therefore, the channel number is reduced from 64 to 16 in the technical solution, the number of redundant channels is simplified, the feature matching intrusion detection model is greatly reduced, the data operation of the feature matching intrusion detection model is reduced, the operation speed of the feature matching intrusion detection model is improved, and the real-time requirement of intrusion detection is ensured.

[0068] Optionally, the method further comprises: training the feature matching intrusion detection model by the following steps: collecting the CAN bus data samples and the intrusion category samples; performing third preprocessing on the CAN bus data samples to generate first feature map samples related to CAN message identifiers; and training the feature matching intrusion detection model according to the first feature map samples and the intrusion category samples by using a supervised contrast loss function.

[0069] Specifically, before the feature matching intrusion detection model is put into use, the training module 230 trains the feature matching intrusion detection model, and the training steps are as follows:

[0070] First, the data processing module 210 acquires CAN bus data samples and corresponding intrusion category samples. Then, the data processing module 210 performs preprocessing (i.e., third preprocessing) on the CAN bus data samples, wherein the third preprocessing operation includes k-means clustering processing. The specific steps are as follows:

[0071] (1) The data processing module 210 randomly initializes k cluster centers, denoted as μ j (j = 1, 2,..., k);

[0072] (2) For the CAN bus data sample s i (i = 1, 2,..., n), the distance of the sample to each cluster center μ j (j = 1, 2,..., k) is calculated, and the CAN bus data sample s i is divided into a certain class according to the distance, and c (i) (the class closest to the sample s i in the k classes) is calculated, and c (i) is calculated. The calculation formula is as follows:

[0073]

[0074] After all samples are divided, the k cluster centers μ j are recalculated, and the calculation formula is as follows:

[0075]

[0076] (3) Repeat (2) until the cluster centers no longer change;

[0077] (4) Discard a certain number of samples from each cluster so that the number of positive samples and negative samples is balanced.

[0078] Further, the data processing module 210 obtains the CAN message identifier of each CAN bus data sample from the CAN bus data samples after clustering processing. The CAN message identifier is a hexadecimal number. Thus, the data processing module 210 converts the CAN message identifier from a hexadecimal number to a binary number to generate a binary CAN message identifier. The extension frame of the CAN message identifier in hexadecimal is up to 18 digits, and after conversion from hexadecimal to binary, the binary number is up to 29 digits. Thus, in this embodiment, the binary number corresponding to the CAN message identifier is set to 29 digits. And the data processing module 210 splices the binary CAN message identifiers of a predetermined number (for example, m) of CAN bus data to generate an m*29 binary image (i.e., a first feature map sample). Then the data processing module 210 sends the first feature map sample to the training module 230.

[0079] Further, the training module 230 takes the first feature map sample as the input sample and takes the intrusion category sample as the output sample, and thus trains the feature matching intrusion detection model according to the first feature map sample and the intrusion category sample by using the supervised contrast loss function.

[0080] In addition, for the first feature map sample, the data processing module 210 obtains the first feature map sample according to the step size of and the width of the sliding window is m.

[0081] Thus, the technical solution obtains the first feature map sample by using the sliding window, which can capture the data change trend in the continuous time period and enhance the understanding ability of the model to the time series data. Moreover, the technical solution converts the CAN message identifier in hexadecimal to a binary number and generates an m*29 binary image (first feature map sample), which not only retains the key information of the original data, but also facilitates the model understanding and learning.

[0082] Optionally, the operation of training the feature matching intrusion detection model by using the supervised contrast loss function includes training the feature matching intrusion detection model by using the following formula:

[0083]

[0084] wherein represents the supervised contrast loss function; N represents the number of CAN bus data samples; τ represents a temperature parameter, which controls the sharpness of the similarity distribution; z i represents the normalized feature vector of the sample i; z j represents the normalized feature vector of the positive sample j; z k represents the normalized feature vector of any sample k; represents the sample i with the same label y iThe number of samples; I is used to determine whether the condition is met, and when the condition is met, I = 1, and when the condition is not met, I = 0.

[0085] Specifically, the training module 230 follows the above-mentioned supervised contrast loss function By using Calculate the similarity between sample i and the same class sample j, Calculate the sum of the similarity of sample i and all other samples (including different classes). Thus, the individual contrast loss of each sample i is calculated, and finally the total loss is obtained by adding all individual losses, so as to minimize the total loss by back propagation, so that the feature vectors of the same class samples are close, and the feature vectors of the different class samples are far away. For a given positive sample, assume that the remaining N-1 samples are negative samples, because only the distance of the positive sample pair is calculated in the numerator, and the negative sample only appears in the denominator of the contrast loss, so when the distance of the positive sample pair is smaller, the distance of the negative sample pair is larger, and the value of the loss function is smaller.

[0086] In addition, the temperature parameter tau controls the smoothness of the probability distribution, and a smaller tau will be beneficial to training, but too small tau will cause unstable training due to numerical instability.

[0087] Therefore, in the technical solution, the supervised contrast loss function can maximize the difference between different categories and minimize the difference within the same category while considering the relationship between samples. This makes the model more accurate in distinguishing normal behavior and abnormal behavior, and improves the effect of intrusion detection.

[0088] Optionally, the feature matching intrusion detection model is a supervised model. Therefore, when the feature matching intrusion detection model is trained, the samples are pre-set with corresponding labels. The labels include various intrusion types, such as normal, Dos, Fuzzy and Spoofing. Therefore, the technical solution adopts a supervised learning method, so that the feature matching intrusion detection model can be exposed to a data set with clear labels during the training stage, so that the feature matching intrusion detection model can more accurately identify existing different types of network threats, and realize the detection of known attacks.

[0089] Optionally, the operation of performing intrusion detection on the CAN bus data by the anomaly statistical intrusion detection model based on zero-sample anomaly detection includes: determining CAN bus messages corresponding to each window position of the sliding window and corresponding third feature information by sliding the sliding window on the CAN bus message sequence corresponding to the CAN bus data; mapping the third feature information by using a feature mapping module based on a neural network to generate corresponding fourth feature information, wherein in the space of the fourth feature information, the features of normal CAN bus data can be clustered and form a cluster center, and the features of abnormal CAN bus data are farther away from the cluster center than the features of normal CAN bus data; and determining whether the corresponding CAN bus message is abnormal based on the fourth feature information.

[0090] Specifically, in a case where the feature matching intrusion detection model determines that the CAN bus data is normal, the data processing module 210 continues to perform second preprocessing on the CAN bus data. Specifically, in the process of the second preprocessing, the data processing module 210 slides a sliding window with a preset width (for example, a sliding window of 200 ms) on the CAN bus message sequence corresponding to the CAN bus data. The step length of each sliding is preferably one message.

[0091] Then the data processing module 210 determines, for each window position of the sliding of the sliding window, the CAN bus messages included in the sliding window as the CAN bus messages corresponding to the window position. And the data processing module 210 also extracts features from the CAN bus messages corresponding to each window position, thereby determining feature information (i.e., third feature information) corresponding to the CAN bus messages of each window position. In this embodiment, the feature information is represented in the form of a vector.

[0092] Specifically, the feature information of the CAN bus messages corresponding to a window position includes the following feature parameters:

[0093] 1) The frequency of occurrence of each CAN ID in the window, for example, multiple elements in the feature information can correspond to the frequency of occurrence of different CAN IDs, so that the frequency of occurrence of each CAN ID in the window can be recorded.

[0094] 2) The Shannon entropy of the data payload bytes in the window, the formula is:

[0095] H(X) = -∑p(x i )logp(x i ).

[0096] x i is the number of payload bytes of the i-th message in the window, and p(x i ) is a probability value corresponding to the number of payload bytes. Specifically, p(xi ) is determined by the following way:

[0097] a. determining the number of payload bytes x of each packet in the window i ;

[0098] b. constructing a histogram reflecting the distribution of the number of payload bytes according to the number of payload bytes x of each packet i ;

[0099] c. according to the histogram, determining the proportion of the number of payload bytes of different sizes as the corresponding probability value, thereby determining the corresponding probability p(x i ) of the number of payload bytes of each packet.

[0100] 3) Period deviation, used to quantify the abnormal fluctuation of the packet period, and the calculation formula is:

[0101] δ = |T obs -T ref | / T ref .

[0102] Wherein, T obs is the actual period of the observed packet, which is calculated by the difference of time stamps, and considering that the sliding window contains multiple packets, the average value of the actual period of each packet is calculated as T obs ; T ref is the standard communication period reference value, which is defined by the ECU protocol specification.

[0103] Therefore, through the above way, the data preprocessing module 210 can generate feature information corresponding to different window positions: Fb1, Fb2, …, Fb n (i.e. the third feature information), wherein each feature information Fb v is a feature vector containing the feature parameters 1) ~ 3) described above.

[0104] Then, the detection module 220 inputs the feature information Fb v into the anomaly statistical intrusion detection model. Wherein, Figure 6A Fig. 2 shows a schematic diagram of the anomaly statistical intrusion model. Referring to Figure 6A , the anomaly statistical intrusion detection model includes a feature mapping module based on neural network and an anomaly detection module. Wherein the feature mapping module is used to map the feature information Fb v into another space feature information Fc v (i.e. the fourth feature information).

[0105] Specifically, in this embodiment, the feature mapping module can be represented as f(x), wherein x in the formula corresponds to the third feature information Fb v described above.

[0106] Specifically, refer to Figure 6B As shown, the feature mapping module can map the third feature information in the left space to the fourth feature information in the right space. Figure 6B In the diagram, black dots represent normal data characteristics, while white dots represent data anomalies. This serves as a reference. Figure 6B As shown, when the third feature information is mapped from the left space to the fourth feature information in the right space, the fourth feature information with normal data can be clustered and form a cluster center o, and the fourth feature information with abnormal data is farther away from the cluster center o than the fourth feature information with normal data.

[0107] Therefore, the anomaly detection module of the anomaly statistical intrusion detection model determines whether the corresponding CAN bus message is abnormal based on the distance between the fourth feature information and the cluster center. Specifically, the anomaly detection module can further calculate the integral related to the distance between the fourth feature information and the cluster center based on the fourth feature information, as shown below:

[0108] S θ (x)=α||f θ (x)-c|| 2 +(1-α)||xG(f θ (x))|| 2

[0109] In the formula, x corresponds to the third feature information Fb mentioned above. v ;f θ (x) is the function corresponding to the feature mapping module, i.e., Fc v＝ f θ (x); α∈[0,1] is the balance factor, and c is the normal data cluster center.

[0110] Furthermore, G() in the formula is a reconstruction function, which can also be an MLP, with the aim of reconstructing f. θ The output after mapping (x) is reconstructed back to x. Using xG(f) θ (x) Calculate the f-norm, which describes the model's reconstruction ability. This score should be small for normal data, but large for outlier data (because MLPs have poor generalization, so outlier data cannot be well reconstructed back to x after f(x), hence the large F-norm of x-Gf(x)). The entire xG(f θ (x) enables the anomaly detection module to distinguish between normal and abnormal data from the reconstruction dimension.

[0111] Therefore, the abnormality detection module can determine whether the CAN bus message corresponding to the fourth feature information is abnormal according to the score. For example, when the score is greater than a preset threshold, it is determined that the CAN bus message corresponding to the fourth feature information is abnormal, otherwise, it is determined that the CAN bus message corresponding to the fourth feature information is normal.

[0112] In addition, the embodiment can also use an alarm association algorithm based on a time causal diagram to reduce the false alarm rate. Specifically, the embodiment can set a 10-second observation window, and three cumulative abnormalities can trigger a final alarm (i.e., detecting an abnormality).

[0113] Optionally, the method further comprises training the abnormality statistical intrusion detection model by: collecting CAN bus data corresponding to a plurality of driving scenes; incorporating CAN bus data of other driving scenes as abnormal data on the basis of CAN bus data of a driving scene corresponding to a training task, to construct a sample data set corresponding to the training task; and training the abnormality statistical intrusion detection model by using the constructed sample data set corresponding to at least one training task.

[0114] According to the technical solution of the present application, in order to train the abnormality statistical intrusion detection model, it is necessary to first construct a sample data set.

[0115] Specifically, normal CAN bus data can be collected in 10 typical driving scenes including cold start, sudden acceleration, high-speed cruising, etc., to ensure data distribution diversity.

[0116] Then, a sample data set for a corresponding training task is constructed for each of the above 10 typical driving scenes. Specifically, for each training task, a batch containing normal samples is sampled, and a small amount of normal CAN bus data of other typical scenes is incorporated as abnormal samples of the batch. For example, for the training task of the sudden acceleration scene, a batch containing normal samples in the sudden acceleration scene is sampled, and a small amount of normal samples in the high-speed cruising scene is incorporated as abnormal samples of the batch. This process helps the model to learn the ability to distinguish between normal and abnormal data under different data distributions.

[0117] Then, the abnormality statistical intrusion detection model is trained by using the sample data set of each training task.

[0118] Further, the operation of training the abnormality statistical intrusion detection model by using the constructed sample data set corresponding to at least one training task comprises: optimizing the intrusion detection model by using the following objective function:

[0119]

[0120] where θ *θ is a parameter of the feature mapping module, and K is a number of training tasks, represents a loss corresponding to a sample data batch of the jth training task.

[0121] Specifically, according to the technical solution of the present application, the constructed sample data set can be used for multi-task training to optimize the model parameter θ, so that the model can map normal data to a unified center under different normal data distributions, and abnormal data is scattered outside the center. The optimization objective function is as follows:

[0122]

[0123] θ is a parameter of the feature mapping module, and K is a number of training tasks, * θ is a parameter of the feature mapping module, and K is a number of training tasks, represents a loss corresponding to a sample data batch of the jth training task.

[0124] Optionally, the method further comprises: the anomaly statistical intrusion detection model is an unsupervised model. Therefore, when training the anomaly statistical intrusion detection model, the samples thereof are not pre-set with corresponding labels. Therefore, the unsupervised learning method is adopted in the technical solution, so that unknown intrusion attacks can be accurately identified when received, thereby realizing detection of unknown attacks.

[0125] Therefore, the anomaly statistical intrusion detection model trained in this way can accurately detect previously unknown intrusion types in CAN bus data under unsupervised training.

[0126] In addition, the following further describes the experimental results of the supervised feature matching intrusion detection system:

[0127] The supervised feature matching intrusion detection system needs to consider three hyperparameters, which are learning rate, batch size, and τ value.

[0128] For convenience, the τ value is set to 0.07.

[0129] For the selection of batch size, the commonly used batch size values in convolutional neural networks are 128, 256, 512, 1024, 2048, etc. Experiments have proved that supervised contrastive loss performs better when feeding large batches of data. Therefore, the performance of the model with batch size of 512, 1024 and 2048 is evaluated. When evaluating, the learning rate is uniformly set to 0.05, and the training rounds (epochs) are 200 rounds, of which the first 170 rounds are the first stage of training, and after 170 rounds, the second stage of training is entered. Using FNR as the evaluation index, we get Figure 7 .

[0130] From Figure 7 , although for supervised contrastive loss, large batch size helps improve model performance, as batch size increases, the FNR of the model does not decrease, on the contrary, the average FNR (the average of the FNR of the four attacks) shows a slight upward trend. Among them, for Dos attack, the FNR value of the model does not increase significantly as the batch size increases, for Fuzzy, Gear Spoofing, RPM Spoofing, the FNR value of the model increases significantly as the batch size increases. The phenomenon is related to the organization method of the input data, because each input data is composed of 29 original data CAN ID fields. The corresponding label is whether there is attack data in the 29 original data. Under the condition that the sampling step is 15 (half of 29), the arrangement method of the original data will affect the label of the input data, and thus the increase of the batch size of the present technical solution will not improve the performance of the model. Finally, the batch size of 512 is selected for the final experimental test.

[0131] For the learning rate, the cosine annealing model is used, which can make the learning rate smoothly decrease during training, helping the model better converge to the global optimal solution. Compared with using a fixed learning rate, using the cosine annealing model can improve the accuracy of the model.

[0132] Reference Figure 8As shown, the batch size is fixed at 512, the training rounds are 200 rounds, the first 170 rounds are the training of the first stage, the F1 Score is used as the evaluation index, and in order to avoid the influence of random numbers on the experimental results, the random state is fixed at 39 in this round of experiment. It can be observed that compared with the fixed learning rate of 0.05, the F1 Score of the model for each classification is improved after adjusting the learning rate using the cosine annealing model (wherein the average F1 Score of the model is 0.976279 when the fixed learning rate is 0.05, and the average F1 Score of the model is 0.984660 after using the cosine annealing model, and the average F1 Score is improved by 0.008381).

[0133] The test results of the supervised feature matching intrusion detection model are as shown in Figure 9 As the epoch training rounds increase, the F1 score of the model increases significantly, indicating that the performance of the model increases with the increase of the epoch. From the experimental result graph, when the epoch is greater than 200, the performance of the model does not increase significantly. Therefore, the epoch is set to 200, and the confusion matrix of the model is as shown in Figure 10

[0134] In addition, according to a second aspect of the embodiment, a computer readable storage medium is provided, and a computer program is stored on the computer readable storage medium, and the computer program is executed by a processor to implement the steps of the above method.

[0135] According to the embodiment, the known attacks are detected by the feature matching intrusion detection model according to the CAN bus data, and the unknown attacks are detected by the anomaly statistical intrusion detection model, so that the feature matching intrusion detection model and the anomaly statistical intrusion detection model can be used to comprehensively detect the intrusion attacks. And the feature map of m*29 is constructed in the technical solution, compared with the input data of 512*512 grayscale image in the prior art, the elements in the feature map are reduced in the technical solution, so that the processing time is reduced and the operation efficiency is improved when the feature matching intrusion detection model processes the feature map. And the encoder in the feature matching intrusion detection model in the technical solution is a compact resnet-18, compared with the traditional resnet-18, the encoder of the compact resnet-18 in the technical solution reduces the number of convolution layers, and the redundant channel number is simplified, so that the feature matching intrusion detection model is greatly reduced. And the data operation of the feature matching intrusion detection model is reduced, the operation speed of the feature matching intrusion detection model is improved, and the real-time requirement of intrusion detection is ensured. Further, the technical problems that the existing vehicle-mounted intrusion detection system cannot detect known attacks and unknown attacks at the same time, and the model set is generally large and the inference time is long, which does not meet the real-time requirement of the vehicle, are solved.​

[0136] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0137] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0138] Example 2

[0139] Figure 11 A CAN bus intrusion detection device 1100 according to this embodiment is shown, which corresponds to the method described according to the first aspect of Embodiment 1. (See reference...) Figure 11 As shown, the device 1100 includes: a first preprocessing module 1110, used to perform first preprocessing on CAN bus data to generate a first feature map related to the CAN message identifier, wherein the number of columns in the first feature map is the same as the number of binary bits in the extended frame of the CAN message identifier; a category determination module 1120, used to process the first feature map through a feature matching intrusion detection model to determine the intrusion category of the CAN bus data; and a second preprocessing module 1130, used to perform second preprocessing on the CAN bus data to generate a second feature map, wherein the second feature map includes a timestamp, the CAN message identifier, and the number of data bytes. The system includes data fields and tags; and an information determination module 1140, used to determine whether CAN bus data is intrusion information based on the second feature map using an anomaly statistical intrusion detection model. The category determination module 1120 includes: a first generation submodule, used to generate first feature information by encoding the first feature map using an encoder with a predetermined number of residual blocks; a second generation submodule, used to extract features from the first feature information using a mapping network to generate second feature information; and a category determination submodule, used to classify the second feature information using a classifier to determine the intrusion category of the CAN bus data.

[0140] Optionally, the first generating sub-module comprises: a first generating unit configured to generate a third feature map by performing convolution processing on the first feature map through a first convolution layer of the encoder; a second generating unit configured to generate a fourth feature map by processing the third feature map through a plurality of residual blocks of the encoder; and a third generating unit configured to generate the first feature information by processing the fourth feature map through an average pooling layer of the encoder, wherein the second generating unit comprises: a second convolution layer with a predetermined number of channel numbers of a first residual block configured to perform convolution operation on the third feature map to generate a fifth feature map; a residual connection configured to generate a sixth feature map by connecting the third feature map and the fifth feature map in a residual manner; a third convolution layer with a predetermined number of channel numbers of a second residual block configured to perform convolution operation on the sixth feature map to generate a seventh feature map; a residual connection configured to generate an eighth feature map by connecting the sixth feature map and the seventh feature map in a residual manner; and a plurality of third residual blocks configured to process the eighth feature map to generate the fourth feature map.

[0141] Optionally, the feature matching intrusion detection model is a supervised model.

[0142] Optionally, the anomaly statistical intrusion detection model is an unsupervised model.

[0143] Optionally, the CAN bus intrusion detection device 1100 further comprises a first training module configured to train the feature matching intrusion detection model by: a first collecting sub-module configured to collect CAN bus data samples and intrusion category samples; a first sample generating sub-module configured to perform third preprocessing on the CAN bus data samples to generate first feature map samples related to CAN message identifiers; and a first training sub-module configured to train the feature matching intrusion detection model according to the first feature map samples and the intrusion category samples by using a supervised contrast loss function.

[0144] Optionally, the first training sub-module comprises: a training unit configured to train the feature matching intrusion detection model by using the following formula:

[0145]

[0146] wherein represents a supervised contrast loss function; N represents the number of CAN bus data samples, i = 1 ~ N; tau represents a temperature parameter, which controls the sharpness of the similarity distribution; z i represents a normalized feature vector of the sample i; z j represents a normalized feature vector of the positive sample j; z k represents a normalized feature vector of any sample k; denotes the samples with the same label y as sample i i the number of samples; I is used to determine whether the condition is met, when the condition is met, I = 1, when the condition is not met, I = 0.

[0147] Optionally, the CAN bus intrusion detection device 1100 further comprises a second training module for training the anomaly statistical intrusion detection model by the following steps: a second acquisition submodule for acquiring CAN bus data samples; a second sample generation submodule for performing fourth preprocessing on the CAN bus data samples to generate second feature map samples related to CAN message identifiers, wherein the second feature map samples include timestamps, CAN message identifiers, data byte numbers, data fields and labels; and a second training submodule for training the anomaly statistical intrusion detection model according to the second feature map samples using a gradient descent algorithm.

[0148] According to the present embodiment, known attacks are detected using the feature matching intrusion detection model according to CAN bus data, and unknown attacks are detected using the anomaly statistical intrusion detection model, so that the technical solution can comprehensively detect intrusion attacks using the feature matching intrusion detection model and the anomaly statistical intrusion detection model. And the technical solution constructs a feature map of m*29, compared with the existing technology in which the input data is a gray image of 512*512, the technical solution reduces the elements in the feature map, thereby reducing the processing time when the feature matching intrusion detection model processes the feature map, and improving the operation efficiency. And the encoder in the feature matching intrusion detection model in the present technical solution is a compact resnet-18, compared with the traditional resnet-18, the encoder of the compact resnet-18 in the present technical solution reduces the number of convolution layers, and simplifies the redundant channel number, so that the feature matching intrusion detection model is greatly reduced. And the data operation of the feature matching intrusion detection model is reduced, the operation speed of the feature matching intrusion detection model is improved, and the real-time requirement of intrusion detection is ensured. Further, the technical problem that the existing vehicle-mounted intrusion detection system cannot detect known attacks and unknown attacks at the same time, and the model set is generally large and the inference time is long, which does not meet the real-time requirement of vehicles, is solved.

[0149] Embodiment 3

[0150] Figure 12 The CAN bus intrusion detection device 1200 according to the present embodiment is shown, which corresponds to the method according to the first aspect of embodiment 1. Referring to Figure 12As shown, the apparatus 1200 includes a processor 1210, and a memory 1220 connected with the processor 1210, configured to provide the processor 1210 with instructions to process the following processing steps: performing first preprocessing on the CAN bus data to generate a first feature map related to the CAN message identifier, wherein the number of columns of the first feature map is the same as the number of binary bits of the extended frame of the CAN message identifier; processing the first feature map through a feature matching intrusion detection model to determine the intrusion category of the CAN bus data; performing second preprocessing on the CAN bus data to generate a second feature map, wherein the second feature map includes a timestamp, a CAN message identifier, a number of data bytes, a data field, and a label; and determining whether the CAN bus data is intrusion information according to the second feature map through an anomaly statistical intrusion detection model, wherein the operation of processing the first feature map through the feature matching intrusion detection model to determine the intrusion category of the CAN bus data includes: performing encoding processing on the first feature map through an encoder provided with a predetermined number of channel numbers of residual blocks to generate first feature information; performing feature extraction on the first feature information through a mapping network to generate second feature information; and classifying the second feature information through a classifier to determine the intrusion category of the CAN bus data.

[0151] Optionally, the operation of performing encoding processing on the first feature map through the encoder provided with a predetermined number of channel numbers of residual blocks to generate the first feature information includes: performing convolution processing on the first feature map through a first convolutional layer of the encoder to generate a third feature map; processing the third feature map through a plurality of residual blocks of the encoder to generate a fourth feature map; and processing the fourth feature map through an average pooling layer of the encoder to generate the first feature information, wherein the operation of processing the third feature map through the plurality of residual blocks of the encoder to generate the fourth feature map includes: performing convolution operation on the third feature map through a second convolutional layer provided with a predetermined number of channel numbers of the first residual block to generate a fifth feature map; performing residual connection on the third feature map and the fifth feature map to generate a sixth feature map; performing convolution operation on the sixth feature map through a third convolutional layer provided with a predetermined number of channel numbers of the second residual block to generate a seventh feature map; performing residual connection on the sixth feature map and the seventh feature map to generate an eighth feature map; and processing the eighth feature map through a plurality of third residual blocks to generate the fourth feature map.

[0152] Optionally, the memory 1220 is further configured to provide the processor 1210 with instructions to process the following processing steps: the feature matching intrusion detection model is a supervised model.

[0153] Optionally, the memory 1220 is further configured to provide the processor 1210 with instructions to process the following processing steps: the anomaly statistical intrusion detection model is an unsupervised model.

[0154] Optionally, the memory 1220 is further configured to provide the processor 1210 with instructions to process the following processing steps: training the feature matching intrusion detection model by the following steps:

[0155] collecting the CAN bus data samples and the intrusion category samples;

[0156] performing third preprocessing on the CAN bus data samples to generate first feature map samples related to CAN message identifiers; and

[0157] training the feature matching intrusion detection model according to the first feature map samples and the intrusion category samples by using a supervised contrastive loss function.

[0158] Optionally, the operation of training the feature matching intrusion detection model by using the supervised contrastive loss function comprises: training the feature matching intrusion detection model by using the following formula:

[0159]

[0160] wherein represents the supervised contrastive loss function; N represents the number of the CAN bus data samples, i = 1 ~ N; τ represents a temperature parameter, controlling the sharpness of the similarity distribution; z i represents the normalized feature vector of the sample i; z j represents the normalized feature vector of the positive sample j; z k represents the normalized feature vector of any sample k; represents the number of samples with the same label y i as the sample i; I is used to determine whether the condition is true, and I = 1 when the condition is true, and I = 0 when the condition is not true.

[0161] Optionally, the memory 1220 is further configured to provide the processor 1210 with instructions to process the following processing steps: training the anomaly statistical intrusion detection model by the following steps:

[0162] collecting the CAN bus data samples;

[0163] performing fourth preprocessing on the CAN bus data samples to generate second feature map samples related to CAN message identifiers, wherein the second feature map samples comprise timestamps, CAN message identifiers, data byte numbers, data fields and labels; and

[0164] training the anomaly statistical intrusion detection model according to the second feature map samples by using a gradient descent algorithm.

[0165] Thus, according to the embodiment, the known attacks are detected by the feature matching intrusion detection model according to the CAN bus data, and the unknown attacks are detected by the anomaly statistical intrusion detection model, so that the technical solution can comprehensively detect the intrusion attacks by using the feature matching intrusion detection model and the anomaly statistical intrusion detection model. And the technical solution constructs a feature map of m*29, compared with the existing input data of 512*512 grayscale image, the technical solution reduces the elements in the feature map, so that the processing time is reduced when the feature matching intrusion detection model processes the feature map, and the operation efficiency is improved. And the encoder in the feature matching intrusion detection model in the technical solution is a compact resnet-18, compared with the traditional resnet-18, the encoder of the compact resnet-18 in the technical solution reduces the convolution layer channel number, and simplifies the redundant channel number, so that the feature matching intrusion detection model is greatly reduced. And the data operation of the feature matching intrusion detection model is reduced, the operation speed of the feature matching intrusion detection model is improved, and the real-time requirement of the intrusion detection is ensured. Further, the technical problem that the existing vehicle-mounted intrusion detection system cannot detect known attacks and unknown attacks at the same time, and the model set is generally large and the inference time is long, which does not meet the real-time requirement of the vehicle, is solved.

[0166] The above-mentioned serial numbers of the embodiments of the application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0167] In the above-mentioned embodiments of the application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0168] In several embodiments provided in the present application, it should be understood that the disclosed technical content can be implemented by other ways. Among them, the above-mentioned device embodiments are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division way, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be indirect coupling or communication connection through some interface, unit or module, which can be electrical or other forms.

[0169] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or they can be distributed on a plurality of network units. According to actual needs, part or all of the units can be selected to achieve the purpose of the embodiment.

[0170] In addition, each function unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software function unit.

[0171] When the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application, essentially or the part that contributes to the prior art, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0172] The above is only the preferred embodiment of the present application, and it should be pointed out that for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be considered as the protection scope of the present application.

Claims

1. A method of CAN bus intrusion detection, characterized in that, The method comprises: performing first preprocessing on CAN bus data to generate a first feature map related to a CAN message identifier, wherein the number of columns of the first feature map is the same as the number of binary bits of an extended frame of the CAN message identifier; processing the first feature map through a feature matching intrusion detection model to determine an intrusion category of the CAN bus data; and in a case where it is determined that the CAN bus data is normal according to the intrusion category, performing intrusion detection on the CAN bus data through an anomaly statistical intrusion detection model based on zero-sample anomaly detection, wherein the operation of processing the first feature map through the feature matching intrusion detection model to determine the intrusion category of the CAN bus data comprises: generating first feature information by performing encoding processing on the first feature map through an encoder provided with a predetermined number of channel numbers; extracting features of the first feature information through a mapping network to generate second feature information; and classifying the second feature information through a classifier to determine the intrusion category of the CAN bus data. the operation of generating first feature information by performing encoding processing on the first feature map through an encoder provided with a predetermined number of channel numbers comprises:

2. The method of claim 1, wherein, performing convolution processing on the first feature map through a first convolution layer of the encoder to generate a third feature map; processing the third feature map through a plurality of residual blocks of the encoder to generate a fourth feature map; and processing the fourth feature map through an average pooling layer of the encoder to generate first feature information, wherein the operation of processing the third feature map through a plurality of residual blocks of the encoder to generate a fourth feature map comprises: performing convolution operation on the third feature map through a second convolution layer provided with the predetermined number of channel numbers of a first residual block to generate a fifth feature map; performing residual connection on the third feature map and the fifth feature map to generate a sixth feature map; performing convolution operation on the sixth feature map through a third convolution layer provided with the predetermined number of channel numbers of a second residual block to generate a seventh feature map; performing residual connection on the sixth feature map and the seventh feature map to generate an eighth feature map; and processing the eighth feature map through a plurality of third residual blocks to generate the fourth feature map. The method further comprises:

3. The method of claim 1, wherein, training the feature matching intrusion detection model through the following steps: collecting CAN bus data samples and intrusion category samples; performing third preprocessing on the CAN bus data samples to generate first feature map samples related to CAN message identifiers; and training the feature matching intrusion detection model according to the first feature map samples and the intrusion category samples by using a supervised contrast loss function. The operation of training the feature matching intrusion detection model by using a supervised contrast loss function comprises training the feature matching intrusion detection model by using the following formula: ​ 4. The method of claim 3, wherein, ​ wherein represents the supervision contrast loss function; N represents the number of CAN bus data samples, i = 1 ~ N; τ represents a temperature parameter, controlling the sharpness of the similarity distribution; z i represents the normalized feature vector of sample i; z j represents the normalized feature vector of positive sample j; z k represents the normalized feature vector of any sample k; represents the number of samples with the same label y i as sample i; I is used to determine whether the condition is true, when the condition is true, I = 1, when the condition is not true, I = 0.

5. The method of claim 1, wherein, Before the operation of performing intrusion detection on the CAN bus data by the anomaly statistical intrusion detection model based on zero-sample anomaly detection, further comprising: sliding a pre-set sliding window in the CAN bus message sequence corresponding to the CAN bus data, so as to determine CAN bus messages corresponding to each window position of the sliding window and corresponding third feature information, and wherein The operation of performing intrusion detection on the CAN bus data by the anomaly statistical intrusion detection model based on zero-sample anomaly detection comprises: Mapping the third feature information by a feature mapping module based on a neural network to generate corresponding fourth feature information, wherein in the space of the fourth feature information, the features of normal CAN bus data can be clustered and form a cluster center, and the features of abnormal CAN bus data are farther away from the cluster center relative to the features of normal CAN bus data; and Determining whether the corresponding CAN bus message is abnormal based on the fourth feature information.

6. The method of claim 5, wherein, Further comprising training the anomaly statistical intrusion detection model by the following operations: Collecting CAN bus data corresponding to a plurality of driving scenes; Introducing CAN bus data of other driving scenes as abnormal data on the basis of CAN bus data of the driving scene corresponding to the training task, to construct a sample data set corresponding to the training task; And Training the anomaly statistical intrusion detection model by using the constructed sample data set corresponding to at least one training task.

7. The method of claim 6, wherein, The operation of training the anomaly statistical intrusion detection model by using the constructed sample data set corresponding to at least one training task comprises: Optimizing the intrusion detection model by using the following objective function: where θ * is an optimization parameter of the feature mapping module, θ is a parameter of the feature mapping module, K is a number of training tasks, denotes a loss corresponding to a batch of sample data of the jth training task.

8. A CAN bus intrusion detection apparatus, characterized by, Comprise: A first preprocessing module for first preprocessing CAN bus data to generate a first feature map related to a CAN message identifier, wherein the number of columns of the first feature map is the same as the number of binary bits of the extended frame of the CAN message identifier; A feature matching intrusion detection module for processing the first feature map by a feature matching intrusion detection model to determine the intrusion category of the CAN bus data; And An anomaly statistical intrusion detection module for performing intrusion detection on the CAN bus data by an anomaly statistical intrusion detection model based on zero-sample anomaly detection in the case of determining that the CAN bus data is normal according to the intrusion category, wherein The category determination module comprises: a first generation submodule for generating first feature information by encoding the first feature map by an encoder provided with a residual block with a predetermined number of channels; a second generation submodule for extracting second feature information by mapping the first feature information by a mapping network; and a category determination submodule for classifying the second feature information by a classifier to determine the intrusion category of the CAN bus data.

9. A CAN bus intrusion detection apparatus, characterized by, Comprise: A processor; And A memory connected with the processor for providing the processor with instructions for processing the following processing steps: The first pre-processing is performed on the CAN bus data to generate a first feature map related to a CAN message identifier, wherein the number of columns of the first feature map is the same as the number of binary bits of an extended frame of the CAN message identifier; The first feature map is processed by a feature matching intrusion detection model to determine an intrusion category of the CAN bus data; and In a case where it is determined according to the intrusion category that the CAN bus data is normal, the CAN bus data is subjected to intrusion detection by an anomaly statistical intrusion detection model based on zero sample anomaly detection, wherein The operation of processing the first feature map by the feature matching intrusion detection model to determine the intrusion category of the CAN bus data comprises: The first feature map is encoded by an encoder provided with a residual block with a predetermined number of channels to generate first feature information; The first feature information is extracted by a mapping network to generate second feature information; and The second feature information is classified by a classifier to determine the intrusion category of the CAN bus data.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by a processor to implement the steps of the method of claim 1.

Images