Cross-vehicle type universal CAN bus causal digital twinning intrusion detection method

Abstract

The invention relates to a cross-vehicle-type universal CAN bus causal digital twin intrusion detection method, and belongs to the technical field of intrusion detection. The method ensures that key causal dependence is kept stable under a cross-vehicle-type condition by modeling and constraining a potential causal relationship in CAN bus data, and the intrusion detection accuracy is improved by combining a virtual vehicle environment driven by digital twin. The operation characteristics and attack scenes of different vehicle types are simulated in the twin space, and then a cross-domain condition prediction model is constructed. According to the method, the influence caused by cross-vehicle-type data distribution difference can be effectively reduced, intrusion detection migration of the target vehicle type is completed at the minimum cost, the generalization ability and interpretability of cross-vehicle-type intrusion detection are improved, and the application range of a vehicle intrusion detection system is expanded.

Description

Technical Field

[0001] This invention belongs to the field of intrusion detection technology, specifically relating to a cross-vehicle universal CAN bus causal digital twin intrusion detection method. Background Technology

[0002] CAN provides technical support for real-time data communication between various Electronic Control Units (ECUs) in a vehicle. However, it lacks sufficient security mechanisms to detect network attacks during communication. Hackers have already compromised the CAN bus and carried out network attacks, such as controlling window operation, hazard lights, and ABS. These network attacks interfere with vehicle control, creating safety hazards, and the CAN bus itself lacks the ability to counter them. Therefore, attaching an Intrusion Detection System (IDS) to the CAN bus to detect network attacks is crucial.

[0003] Traditional CAN bus intrusion detection methods, such as the vehicle network intrusion detection method published in patent application CN113824684A, extract the IDs of 29 consecutive CAN messages and convert the CANID sequence into a feature matrix as input. A DenseNet-based detection model extracts the temporal features of this feature matrix; a GAN-based detection model further extracts the temporal features of the feature matrix to determine if they match the characteristics of an unknown attack. If so, an alarm is issued, and the sample is stored as an unknown attack sample. When a certain number of stored samples are found, PCA is used to reduce the dimensionality of the stored unknown attack samples, and Meanshift is used to classify the dimensionality-reduced samples, resulting in an unknown attack dataset with pre-classified labels, thus updating the intrusion detection system.

[0004] A key objective of cross-vehicle intrusion detection is to achieve rapid model adaptation across different vehicle models. Traditional methods typically involve collecting large amounts of CAN bus data and retraining the wireless intrusion detection system (IDS) for each vehicle model, following the methods described above for vehicular network intrusion detection. This approach ignores the potential for transferability of the source vehicle model, resulting in high data collection and training costs for each additional vehicle model when significant differences exist. Existing cross-vehicle intrusion detection methods face two main challenges that hinder efficient implementation: (i) significant differences in distribution between different vehicle models make direct transfer of the source model difficult; and (ii) the high cost of retraining the IDS and the lack of efficient adaptation mechanisms for limited data. Summary of the Invention

[0005] The purpose of this invention is to provide a cross-vehicle CAN bus intrusion detection method with remapped transferable code, in order to solve the problems of traditional cross-vehicle intrusion detection being difficult to transfer directly and having high training costs.

[0006] To achieve the above objectives, the technical solution of the present invention is as follows:

[0007] This invention relates to a cross-vehicle universal CAN bus causal digital twin intrusion detection method, which includes the following steps:

[0008] S1. Denoise, align, and window the CAN messages of the source and target vehicle models, and group them according to the vehicle model and driving primitives.

[0009] S2. Construct a lightweight digital twin and generate counterfactual samples by interfering with the CAN messages of the original vehicle model;

[0010] S3. Establish an intrusion classification model and impose cross-environment consistency and causal invariance constraints on potential causal relationships. Train the intrusion classification model based on the grouped source vehicle CAN messages and counterfactual samples.

[0011] S4. Select several target vehicle CAN messages and manually annotate them to fine-tune the last layer of the classification model. Align the feature mean values ​​of the source and target domains under the same driving primitive, add alignment constraints, and jointly optimize the fine-tuned classification model by combining the classification loss and alignment loss.

[0012] S5. An optimized classification model is used for cross-vehicle CAN bus intrusion detection.

[0013] Preferably, the specific steps in S1 are as follows:

[0014] S1.1. Noise Reduction: Remove messages that do not conform to the normal CAN message format;

[0015] S1.2. Alignment: The time base, CAN ID and signal definition of different vehicle models are aligned by means of time sampling, ID mapping and normalization respectively;

[0016] S1.3. Windowing: Divide the continuous message stream into segments of fixed length, which serve as the input units of the model;

[0017] S1.4. Environment Grouping: Environment grouping is performed based on vehicle type and vehicle driving primitive data.

[0018] Preferably, the primitive data in S1.4 includes the following known normalized signals: vehicle speed. ,accelerator ,brake Steering wheel angle gear ;

[0019] The specific steps of S1.4 for environmental grouping based on vehicle type and vehicle driving primitive data are as follows:

[0020] S1.4.1. Vehicle Model Adaptive Threshold Determination: For each vehicle model, the distribution of vehicle speed, first-order difference of vehicle speed, throttle opening, braking intensity, steering wheel angle and yaw rate are statistically analyzed. Thresholds are determined based on percentiles, including: low speed threshold P20, high throttle threshold P70, high braking threshold P70, upper and lower bounds of acceleration intensity threshold P80 / P20, and steering / yaw intensity threshold P70.

[0021] S1.4.2. Window Feature Value Calculation: For each window after alignment and windowing, calculate one or more of the following statistics as window feature values: average vehicle speed, vehicle speed variance, average first-order difference, percentage of time the throttle is above the throttle threshold, percentage of time the braking is above the braking threshold, average steering wheel angle and / or average yaw rate, and percentage of time in reverse gear.

[0022] S1.4.3. Determine the primitives according to the priority rules;

[0023] S1.4.4. Environment Label Generation: Combine the vehicle model identifier of each window with the determined driving primitive to form an environment label, and group CAN messages with the same environment label together.

[0024] Preferably, the specific steps for constructing a lightweight digital twin in step S2 are as follows:

[0025] S2.1. Time characteristic modeling: Statistically analyze the transmission period and jitter range of each CANID to obtain a time distribution table, so that the twin can send messages at the correct time;

[0026] S2.2. Content characteristic modeling: Perform distribution statistics on the payload area in the CAN message to ensure that the twin can generate message content within the correct value range;

[0027] The specific steps in S2 to generate counterfactual samples by intervening in the observed samples are as follows:

[0028] S2.3. Data for constructing attack scenarios by artificially interfering with the normal message flow.

[0029] Preferably, the classification loss of the classification model in S3 is expressed as:

[0030] ,

[0031] in, For classification loss function, This is the true label for model i. Predict the classification probability for vehicle model i;

[0032] The cross-environment consistency constraint in S3 is expressed as follows:

[0033] ,

[0034] in, To ensure consistency across environments, and The messages are for vehicle model i and vehicle model j, respectively;

[0035] The joint objective based on classification loss and cross-environment consistency constraint is expressed as:

[0036] ,

[0037] in, For the common goal, To control the trade-off between classification accuracy and consistency constraints.

[0038] Preferably, the alignment constraint in S4 is expressed as:

[0039] ,

[0040] in, For feature alignment loss, Let p be the p-th feature component of category c in the source vehicle model. Let p be the p-th feature component of category c in the target vehicle model;

[0041] The joint classification loss and alignment loss in S4 are expressed as follows:

[0042] ,

[0043] in, It is the target domain classification loss. It is a trade-off coefficient.

[0044] Preferably, S5 uses an optimized classification model to detect cross-vehicle CAN bus intrusions, outputs a detection score and category, and outputs an alarm and category when the score exceeds a set alarm threshold.

[0045] Preferably, the alarm threshold is determined as follows:

[0046] ,

[0047] in, This is the alarm threshold. To test the score, This indicates that quantiles are calculated only on normal samples. It is an index of quantiles. It is a quantile function;

[0048] If the false alarm rate is too high within a short period of time under this alarm threshold, the alarm threshold will be finely adjusted by a fixed ratio of 0.95.

[0049] Compared with the prior art, the technical solution provided by this invention has the following advantages:

[0050] This invention relates to a cross-vehicle universal CAN bus causal digital twin intrusion detection method. By modeling and constraining the potential causal relationships in CAN bus data, it ensures the stability of key causal dependencies under cross-vehicle conditions. Combined with a virtual vehicle environment driven by digital twins, it simulates the operating characteristics and attack scenarios of different vehicle models in the twin space, thereby constructing a cross-domain condition prediction model. This method can effectively reduce the impact of differences in cross-vehicle data distribution, achieving intrusion detection migration of the target vehicle model at minimal cost. It not only improves the generalization ability and interpretability of cross-vehicle intrusion detection but also expands the applicability of vehicle intrusion detection systems. Attached Figure Description

[0051] Figure 1 A flowchart for a cross-vehicle universal CAN bus causal digital twin intrusion detection method. Detailed Implementation

[0052] To further understand the content of this invention, the invention will be described in detail with reference to the embodiments. The following embodiments are used to illustrate the invention, but are not intended to limit the scope of the invention.

[0053] See attached document Figure 1 As shown, this invention relates to a cross-vehicle universal CAN bus causal digital twin intrusion detection method, which includes the following steps:

[0054] S1. Denoise, align, and window the CAN messages of the source and target vehicle models, and group them according to vehicle model and driving primitives. The specific steps are as follows:

[0055] S1.1. Denoising: Remove messages that do not conform to the normal CAN message format to avoid noise affecting model learning;

[0056] S1.2. Alignment: The CANID, signal definition and time base may be inconsistent for different vehicle models. The time base, CANID and signal definition of different vehicle models are aligned by means of time sampling, ID mapping and normalization respectively.

[0057] S1.3. Windowing: Divide the continuous message stream into segments of fixed length, which serve as the input units of the model;

[0058] S1.4. Environment Grouping: Environment grouping is performed based on vehicle type and primitive data for model training and fine-tuning, to avoid the model only learning the differences in driving environment and road conditions and losing the ability to generalize across vehicle types;

[0059] The primitive data mentioned includes the following known normalized signals: vehicle speed ,accelerator ,brake Steering wheel angle gear Based on the above primitive data, the specific steps for environment grouping are as follows:

[0060] S1.4.1. Vehicle Model Adaptive Threshold Determination: For each vehicle model, the distribution of vehicle speed, first-order difference of vehicle speed (used to characterize acceleration approximation), throttle opening, braking intensity, steering wheel angle and yaw rate are statistically analyzed. Thresholds are determined based on percentiles, including: low speed threshold P20, high throttle threshold P70, high braking threshold P70, upper and lower bounds of acceleration intensity threshold P80 / P20, and steering / yaw intensity threshold P70.

[0061] S1.4.2. Window Feature Value Calculation: For each window after alignment and windowing, calculate one or more of the following statistics as window feature values: average vehicle speed, vehicle speed variance, average first-order difference, percentage of time the throttle is above the throttle threshold, percentage of time the braking is above the braking threshold, average steering wheel angle and / or average yaw rate, and percentage of time in reverse gear (R gear).

[0062] S1.4.3. Primitive determination is performed according to priority rules. The priority rules in this embodiment are as follows: the priorities from top to bottom are reverse, braking / deceleration, acceleration, left turn, right turn, constant speed, idle speed, and low-speed maneuvering / parking; specifically: when the R gear time accounts for ≥50% within the window, it is determined as reverse; otherwise, if the braking percentage is higher than the P70 threshold and / or the average first-order difference is lower than the P20 threshold, it is determined as braking / deceleration; otherwise, if the throttle percentage is higher than the P70 threshold and the average first-order difference is higher than the P80 threshold, it is determined as acceleration; otherwise, if the average yaw rate is positive and its amplitude is higher than the P70 threshold and / or the average steering wheel angle is positive and its amplitude is higher than the P70 threshold, it is determined as acceleration. If the average yaw rate is negative and its amplitude is higher than the P70 threshold and / or the average steering wheel angle is negative and its amplitude is higher than the P70 threshold, then it is determined to be a right turn; otherwise, if the absolute value of the average first-order difference is small and the vehicle speed variance is small, then it is determined to be a constant speed; otherwise, if the average vehicle speed is lower than the P20 threshold, then it is determined to be idling; otherwise, if the average vehicle speed is lower than the P20 threshold and the steering or yaw activity is high, then it is determined to be low-speed maneuvering / parking; when multiple conditions are met simultaneously in the same window, the unique determination principle of "hit determines class" is adopted according to the aforementioned priority; the judgment priority order can be adjusted according to the actual situation, and any judgment order falls within the protection scope of this invention;

[0063] S1.4.4. Environment Label Generation: Combine the vehicle model identifier of each window with the determined driving primitive to form an environment label e = (vehicle model ID, primitive), and group CAN messages with the same environment label together.

[0064] S2. Construct a lightweight digital twin by interfering with the CAN messages of the original vehicle model to generate counterfactual samples; the specific steps for constructing the lightweight digital twin are as follows:

[0065] S2.1. Time characteristic modeling: Statistically analyze the transmission period and jitter range of each CANID to obtain a time distribution table, so that the twin can send messages at the correct time;

[0066] S2.2. Content characteristic modeling: Perform distribution statistics on the payload area in the CAN message to ensure that the twin can generate message content within the correct value range;

[0067] By modeling time characteristics and content characteristics, a lightweight model capable of generating "normal CAN messages" is abstracted.

[0068] The specific steps in S2 to generate counterfactual samples by intervening in the observed samples are as follows:

[0069] S2.3. By artificially intervening in the normal message flow, the interventions include value substitution (permutation) intervention, scaling / offset intervention, local perturbation (bounded noise) intervention, and replay / time shift intervention. Data for attack scenarios are constructed by applying these interventions and used for IDS training and verification.

[0070] S3. Establish an intrusion classification model and impose cross-environment consistency and causal invariance constraints on potential causal relationships. Train the classification model with the joint objective of classification loss and cross-environment consistency constraints to ensure that the discrimination direction of the same label remains consistent in different environments. Train the intrusion classification model based on the grouped source vehicle CAN messages and counterfactual samples.

[0071] The classification loss of the classification model is used to ensure that the model can correctly distinguish between normal and attack packets, thus representing the causal invariance constraint, which is expressed as:

[0072] ,

[0073] in, For classification loss function, This is the true label for model i. Predict the classification probability for vehicle model i;

[0074] Cross-environment consistency constraints are used to ensure that the model learns the "attack essence" rather than "environmental features" in different environments, and are expressed as follows:

[0075] ,

[0076] in, To ensure consistency across environments, and The messages are for vehicle model i and vehicle model j, respectively. This represents the loss term. The closer the value is to 0, the better the consistency of the features learned by the model is, and the closer it is to 1, the greater the difference in features.

[0077] The joint objective is expressed as:

[0078] ,

[0079] in, For the common goal, To control the trade-off between classification accuracy and consistency constraints.

[0080] S4. Select CAN messages of several target vehicle models. Under different driving primitives of the target vehicle models (such as acceleration, braking, constant speed, turning), collect a small number of CAN message windows and manually label them (normal / attack type) to form a small number of labeled samples. These are used to fine-tune the last layer of the classification model, that is, freeze the feature extractor parameters and unfreeze the last layer classification head. The last layer is trained with a small number of labeled samples of the target vehicle models.

[0081] Furthermore, under the same driving primitive, the feature mean values ​​of the source and target domains are aligned, alignment constraints are added, and the classification loss and alignment loss are combined to optimize the fine-tuned classification model.

[0082] The alignment constraint is expressed as follows:

[0083] ,

[0084] in, For feature alignment loss, Let p be the p-th feature component of category c in the source vehicle model. Let p be the p-th feature component of category c in the target vehicle model. It represents the difference in mean characteristics between the source vehicle model and the target vehicle model in similar samples;

[0085] The joint objective based on classification loss and cross-environment consistency constraint is expressed as:

[0086] ,

[0087] in, It is the target domain classification loss. It is a trade-off coefficient.

[0088] S5. An optimized classification model is used for cross-vehicle CAN bus intrusion detection, outputting the detection category. Simultaneously, a detection score is calculated using normal segments, and the highest quantile is used as the alarm threshold. If the detection score in the next detection process exceeds the alarm threshold, an alarm is output. The alarm threshold is determined as follows:

[0089] ,

[0090] in, This is the alarm threshold. To test the score, This indicates that quantiles are calculated only on normal samples. It is an index of quantiles. It is a quantile function;

[0091] If the false alarm rate is too high within a short period of time under this alarm threshold, the alarm threshold will be finely adjusted by a fixed ratio of 0.95.

[0092] The present invention has been described in detail above with reference to the embodiments, but the content described is only a preferred embodiment of the present invention and should not be considered as limiting the scope of the present invention. All equivalent changes and improvements made in accordance with the scope of the present invention should still fall within the patent coverage of the present invention.

Claims

1. A cross-vehicle universal CAN bus causal digital twin intrusion detection method, characterized in that: It includes the following steps: S1. Denoise, align, and window the CAN messages of the source and target vehicle models, and group them according to the vehicle model and driving primitives. S2. Construct a lightweight digital twin and generate counterfactual samples by interfering with the CAN messages of the original vehicle model; S3. Establish an intrusion classification model and impose cross-environment consistency and causal invariance constraints on potential causal relationships. Train the intrusion classification model based on the grouped source vehicle CAN messages and counterfactual samples. S4. Select several target vehicle CAN messages and manually annotate them to fine-tune the last layer of the classification model. Align the feature mean values ​​of the source and target domains under the same driving primitive, add alignment constraints, and jointly optimize the fine-tuned classification model by combining the classification loss and alignment loss. S5. An optimized classification model is used for cross-vehicle CAN bus intrusion detection.

2. The cross-vehicle universal CAN bus causal digital twin intrusion detection method according to claim 1, characterized in that: The specific steps in S1 are as follows: S1.

1. Noise Reduction: Remove messages that do not conform to the normal CAN message format; S1.

2. Alignment: The time base, CAN ID and signal definition of different vehicle models are aligned by means of time sampling, ID mapping and normalization respectively; S1.

3. Windowing: Divide the continuous message stream into segments of fixed length, which serve as the input units of the model; S1.

4. Environment Grouping: Environment grouping is performed based on vehicle type and vehicle driving primitive data.

3. The cross-vehicle universal CAN bus causal digital twin intrusion detection method according to claim 2, characterized in that: The primitive data in S1.4 includes the following known normalized signals: vehicle speed ,accelerator ,brake Steering wheel angle gear ; The specific steps of S1.4 for environmental grouping based on vehicle type and vehicle driving primitive data are as follows: S1.4.

1. Vehicle Model Adaptive Threshold Determination: For each vehicle model, the distribution of vehicle speed, first-order difference of vehicle speed, throttle opening, braking intensity, steering wheel angle and yaw rate are statistically analyzed. Thresholds are determined based on percentiles, including: low speed threshold P20, high throttle threshold P70, high braking threshold P70, upper and lower bounds of acceleration intensity threshold P80 / P20, and steering / yaw intensity threshold P70. S1.4.

2. Window Feature Value Calculation: For each window after alignment and windowing, calculate one or more of the following statistics as window feature values: average vehicle speed, vehicle speed variance, average first-order difference, percentage of time the throttle is above the throttle threshold, percentage of time the braking is above the braking threshold, average steering wheel angle and / or average yaw rate, and percentage of time in reverse gear. S1.4.

3. Determine primitives according to priority rules; S1.4.

4. Environment Label Generation: Combine the vehicle model identifier of each window with the determined driving primitive to form an environment label, and group CAN messages with the same environment label together.

4. The cross-vehicle universal CAN bus causal digital twin intrusion detection method according to claim 1, characterized in that: The specific steps for constructing a lightweight digital twin in S2 are as follows: S2.

1. Time characteristic modeling: Statistically analyze the transmission period and jitter range of each CANID to obtain a time distribution table, so that the twin can send messages at the correct time; S2.

2. Content characteristic modeling: Perform distribution statistics on the payload area in the CAN message to ensure that the twin can generate message content within the correct value range; The specific steps in S2 to generate counterfactual samples by intervening in the observed samples are as follows: S2.

3. Data for constructing attack scenarios by artificially interfering with the normal message flow.

5. The cross-vehicle universal CAN bus causal digital twin intrusion detection method according to claim 1, characterized in that: The classification loss of the classification model in S3 is expressed as: ， in, For classification loss function, This is the true label for model i. Predict the classification probability for vehicle model i; The cross-environment consistency constraint in S3 is expressed as follows: ， in, To ensure consistency across environments, and The messages are for vehicle model i and vehicle model j, respectively; The joint objective based on classification loss and cross-environment consistency constraint is expressed as: ， in, For the common goal, To control the trade-off between classification accuracy and consistency constraints.

6. The cross-vehicle universal CAN bus causal digital twin intrusion detection method according to claim 1, characterized in that: The alignment constraint in S4 is expressed as follows: ， in, For feature alignment loss, Let p be the p-th feature component of category c in the source vehicle model. Let p be the p-th feature component of category c in the target vehicle model; The joint classification loss and alignment loss in S4 are expressed as follows: ， in, It is the target domain classification loss. It is a trade-off coefficient.

7. The cross-vehicle universal CAN bus causal digital twin intrusion detection method according to claim 1, characterized in that: The S5 uses an optimized classification model to detect cross-vehicle CAN bus intrusions, outputting a detection score and category. When the score exceeds the set alarm threshold, it outputs an alarm and category.

8. The cross-vehicle universal CAN bus causal digital twin intrusion detection method according to claim 7, characterized in that: The method for determining the alarm threshold is expressed as follows: ， in, This is the alarm threshold. To test the score, This indicates that quantiles are calculated only on normal samples. It is an index of quantiles. It is a quantile function; If the false alarm rate is too high within a short period of time under this alarm threshold, the alarm threshold will be finely adjusted by a fixed ratio of 0.95.

Images