Vehicle-mounted Ethernet intrusion detection method and related device
By using unsupervised learning to fuse and compress features of vehicular Ethernet traffic data, the problem of insufficient detection accuracy and robustness in existing technologies is solved, and efficient vehicular Ethernet intrusion detection is achieved.
Patent Information
- Application Number
- CN202511786253.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-28
- Publication Date
- 2026-02-10
AI Technical Summary
Existing automotive Ethernet intrusion detection methods rely on supervised learning, which requires a large number of labeled attack samples. However, these samples are difficult to obtain in actual automotive environments, resulting in insufficient detection accuracy and robustness.
An unsupervised learning approach is adopted to extract features from vehicular Ethernet traffic data, fuse load features, time features, and transfer relationship features, and use an autoencoder and dot mapper to perform multimodal feature fusion and compression to identify abnormal intrusions.
It improves the accuracy and robustness of in-vehicle Ethernet intrusion detection, enabling efficient detection without attacking sample tags and adapting to complex hybrid network environments.
Smart Images
Figure CN121509028A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of vehicle network detection, in particular to a vehicle Ethernet intrusion detection method and related device. BACKGROUND
[0002] To meet the requirements of intelligentization, networking, automatic driving and big data application on vehicle communication bandwidth and security, vehicle Ethernet gradually enters the research and application system of vehicle manufacturers, and is widely used in sensor data transmission, vehicle entertainment, automatic driving decision and other fields. However, key links such as powertrain and chassis control still rely on CAN / CAN-FD bus, resulting in a complex hybrid network of coexistence of Ethernet and CAN in the vehicle system. In this environment, the high openness and multi-protocol characteristics of vehicle Ethernet make it more vulnerable to network attack risks, including video stream injection, time synchronization destruction, CAN message replay, etc.
[0003] Traditional CAN / LIN / CAN-FD bus mainly faces low-bandwidth and high-real-time application, and its attack detection technology is relatively mature, but it has obvious shortcomings in the face of vehicle Ethernet. First, existing Ethernet intrusion detection systems mostly rely on supervised learning, which requires a large number of labeled attack samples, but it is difficult to obtain attack data in actual vehicle environment. Second, existing methods are mostly trained based on single features (such as message payload or protocol sequence), resulting in insufficient detection accuracy and robustness. Therefore, the existing method has the problems of insufficient accuracy and robustness. SUMMARY
[0004] To solve the above problems, the embodiments of the present application provide a vehicle Ethernet intrusion detection method and related device, which can improve the accuracy and robustness of vehicle Ethernet intrusion detection.
[0005] According to an aspect of the embodiments of the present application, a vehicle Ethernet intrusion detection method is provided, applied to an Ethernet real-time observation system, the Ethernet real-time observation system comprising an Ethernet traffic collection system, an offline training modeler and an online anomaly detector, the method comprising: receiving vehicle traffic data collected by the Ethernet traffic collection system; extracting features from the vehicle traffic data to obtain payload features for characterizing a specified byte range of intercepted messages, time features for characterizing differences between adjacent messages, and transition relationship features for characterizing behavior patterns and sequence dependencies at the protocol level; fusing the payload features, the time features and the transition relationship features to obtain multi-modal fusion features; performing unsupervised training through the multi-modal fusion features to obtain low-dimensional latent vectors; Compress the low-dimensional potential vector to a low-dimensional point space to obtain a clustering center with a preset reference point as a normal sample; Determine the Euclidean distance between the input feature point and the preset reference point, and if the Euclidean distance between the input feature point and the preset reference point is greater than a preset reference threshold, it is determined that the time corresponding to the input feature point has abnormal intrusion.
[0006] In the above scheme, the load feature is obtained by the following steps: Determine each frame of message in the vehicle-mounted traffic data; Extract message data of a specified byte range from each frame of message, and construct a load matrix according to the message data; Determine the load feature according to the load matrix.
[0007] In the above scheme, the time feature is obtained by the following steps: Determine the mean, standard deviation and skewness of the time interval between adjacent messages; The mean, standard deviation and skewness of the time interval between adjacent messages are taken as the time feature.
[0008] In the above scheme, the offline training modeler includes an autoencoder, and the load feature, the time feature and the transition relationship feature are fused to obtain a multi-modal fusion feature, including: The load feature, the time feature and the transition relationship feature are input into the autoencoder to obtain the multi-modal fusion feature output by the autoencoder.
[0009] In the above scheme, the offline training modeler further includes a point mapper, and the low-dimensional potential vector is compressed to a low-dimensional point space by the point mapper. The low-dimensional potential vector is compressed to a low-dimensional point space by the point mapper.
[0010] In the above scheme, if the Euclidean distance between the input feature point and the preset reference point is greater than a preset reference threshold, it is determined that the time corresponding to the input feature point has abnormal intrusion, including: The Euclidean distance between the input feature point and the preset reference point is taken as an outlier score, and if the outlier score is greater than a preset reference threshold, it is determined that the time corresponding to the input feature point has abnormal intrusion.
[0011] In the above scheme, the Ethernet traffic collection system collects data from the vehicle-mounted switch to obtain the vehicle-mounted traffic data.
[0012] According to an aspect of the embodiments of the present application, a vehicle-mounted Ethernet intrusion detection device is provided, which is applied to an Ethernet real-time observation system, the Ethernet real-time observation system comprises an Ethernet traffic collection system, an offline training modeler and an online anomaly detector, and the device comprises: a receiving unit configured to receive vehicle-mounted traffic data collected by the Ethernet traffic collection system; a feature extraction unit configured to perform feature extraction on the vehicle-mounted traffic data to obtain a payload feature for representing a specified byte range of intercepted packets, a time feature for representing differences between adjacent packets, and a transition relationship feature for representing behavior patterns and sequence dependencies at a protocol level; a feature fusion unit configured to fuse the payload feature, the time feature and the transition relationship feature to obtain a multi-modal fusion feature; a training unit configured to perform unsupervised training based on the multi-modal fusion feature to obtain a low-dimensional latent vector; a clustering unit configured to compress the low-dimensional latent vector to a low-dimensional point space to obtain a clustering center with a preset reference point as a normal sample; a detection unit configured to determine an Euclidean distance between an input feature point and the preset reference point, and determine that an abnormal intrusion exists at a time corresponding to the input feature point if the Euclidean distance is greater than a preset reference threshold.
[0013] According to an aspect of the embodiments of the present application, an electronic device is provided, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the vehicle-mounted Ethernet intrusion detection method as described above when executing the computer program. According to an aspect of the embodiments of the present application, a computer program product is provided, which comprises a computer program, the computer program is read and executed by a processor of an electronic device, so that the electronic device performs the vehicle-mounted Ethernet intrusion detection method as described above.
[0014] The present application has the following beneficial effects: the vehicle-mounted traffic data collected by the Ethernet traffic collection system is subjected to feature extraction to obtain three-dimensional features, i.e., a payload feature for representing a specified byte range of intercepted packets, a time feature for representing differences between adjacent packets, and a transition relationship feature for representing behavior patterns and sequence dependencies at a protocol level. The payload feature, the time feature and the transition relationship feature are fused to obtain a multi-modal fusion feature, which can be subjected to unsupervised training, i.e., without samples for supervised training, thereby solving the problems of training difficulty and insufficient training accuracy caused by insufficient samples in the prior art. BRIEF DESCRIPTION OF DRAWINGS
[0015] Figure 1 is a system architecture diagram applied by the vehicle-mounted Ethernet intrusion detection method provided by the embodiment of the present application; Figure 2 is a flowchart of the vehicle-mounted Ethernet intrusion detection method provided by the embodiment of the present application; Figure 3 is an architecture diagram of the Ethernet real-time observation system provided by the embodiment of the present application; Figure 4 is a block diagram of the vehicle-mounted Ethernet intrusion detection device provided by the embodiment of the present application; Figure 5 is a structural schematic diagram of a terminal provided by the embodiment of the present application; Figure 6 is a structural schematic diagram of a server provided by the embodiment of the present application. DETAILED DESCRIPTION
[0016] In order to enable personnel in the art to better understand the scheme of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.
[0017] It should be noted that in some processes described in the specification, claims and the above drawings, a plurality of steps appearing in a specific order are included, but it should be clearly understood that these steps can be executed or executed in parallel without the order in which they appear in this text. The step number is only used to distinguish different steps, and the number itself does not represent any execution order. In addition, the descriptions such as "first", "second" or "target" in this text are used to distinguish similar objects and do not necessarily describe a specific order or sequence. "Multiple" in this text means at least two.
[0018] It should be noted that in the detailed description of the present application, related data such as vehicle-mounted traffic data is involved. When the embodiments of the present application are applied to specific products or technologies, the permission or consent of the target object is required, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards. For example, when the embodiments of the present application need to obtain related data such as steering wheel angle, vehicle speed, yaw angular velocity, etc. of the vehicle, the separate permission or separate consent of the target object can be obtained through a pop-up window or a jump to a confirmation page, etc. After obtaining the separate permission or separate consent of the target object, the necessary steering wheel angle, vehicle speed, yaw angular velocity, etc. for the normal operation of the embodiments of the present application are obtained.
[0019] Please refer to Figure 1 , Figure 1 is a system architecture diagram applied by the vehicle-mounted Ethernet intrusion detection method provided by the embodiment of the present application. It comprises a terminal 140, an Internet 130, a gateway 120, a server 110, etc.
[0020] The terminal 140 comprises a desktop computer, a laptop computer, a PDA (personal digital assistant), a mobile phone, a vehicle-mounted terminal, a special terminal, etc. in addition, it can be a single device or a combination of multiple devices. For example, multiple desktop computers are connected to each other through a local area network and work cooperatively by sharing a display, etc. to jointly constitute a terminal 140. The terminal 140 can communicate with the Internet 130 in a wired or wireless manner to exchange data.
[0021] The server 110 refers to a computer system capable of providing certain services for the terminal 140. Compared with the ordinary terminal 140, the server 110 has higher requirements in stability, security, performance, etc. The server 110 can be a high-performance computer in a network platform, a cluster of multiple high-performance computers, a part (for example, a virtual machine) of a high-performance computer, a combination of parts (for example, virtual machines) of multiple high-performance computers, etc. The server 110 can also communicate with the Internet 130 in a wired or wireless manner to exchange data.
[0022] The gateway 120 is also called an inter-network connector or a protocol converter. The gateway realizes network interconnection at the transport layer and is a computer system or device acting as a conversion function. In the case of two systems using different communication protocols, data formats or languages, or even having completely different architectures, the gateway is a translator. At the same time, the gateway can also provide filtering and security functions. The messages sent by the terminal 140 to the server 110 are sent to the corresponding server 110 through the gateway 120. The messages sent by the server 110 to the terminal 140 are also sent to the corresponding terminal 140 through the gateway 120.
[0023] The specific embodiments of the embodiment of the present application are described in detail as follows: Please refer to Figure 2 , Figure 2 is a flowchart of the vehicle-mounted Ethernet intrusion detection method provided by the embodiment of the present application. The vehicle-mounted Ethernet intrusion detection method can be realized by the server 110 and / or the terminal 140. Figure 2 The vehicle-mounted Ethernet intrusion detection method shown comprises: Step 210, receiving vehicle-mounted traffic data collected by the Ethernet traffic collection system; Step 220: Extract features from the vehicle traffic data to obtain payload features for characterizing a specified byte range of intercepted messages, time features for characterizing the differences between adjacent messages, and transition relationship features for characterizing protocol-level behavioral patterns and sequence dependencies. Step 230: Fuse the load features, the time features, and the transfer relationship features to obtain multimodal fusion features; Step 240: Perform unsupervised training using the multimodal fusion features to obtain a low-dimensional latent vector; Step 250: Compress the low-dimensional latent vector into a low-dimensional point space to obtain clustering centers of normal samples with preset reference points as the clustering centers. Step 260: Determine the Euclidean distance between the input feature point and the preset reference point. If the Euclidean distance between the input feature point and the preset reference point is greater than the preset reference threshold, it is determined that there is an abnormal intrusion at the time corresponding to the input feature point.
[0024] The complete embodiment of this application will be explained in detail below with reference to steps 210-260: First, the architecture diagram of the Ethernet real-time observation system of this application is as follows: Figure 3 As shown, it includes an offline model trainer and an online anomaly detector, while the Ethernet traffic acquisition system, although not included... Figure 3 As shown, however, the Ethernet traffic acquisition system is used to collect vehicle traffic data from the switch.
[0025] In step 210, the vehicle traffic data collected by the Ethernet traffic acquisition system is received. Specifically, the mirrored traffic of the vehicle Ethernet switch is collected and buffered for a fixed duration as a time window, which is used as input for offline training and online detection.
[0026] In step 220, feature extraction is performed on the vehicle traffic data to obtain payload features for characterizing a specified byte range of intercepted messages, time features for characterizing the differences between adjacent messages, and transfer relationship features for characterizing protocol-level behavioral patterns and sequence dependencies.
[0027] In some embodiments, the load characteristics are obtained through the following steps: Identify each frame of the in-vehicle traffic data; Extract a specified range of message data from each frame, and construct a payload matrix based on the message data; The load characteristics are determined based on the load matrix.
[0028] Specifically, a payload matrix is constructed by extracting a specified byte range from each frame of data, avoiding reliance on source or destination addresses and other fields that are prone to overfitting, reducing sensitivity to specific topologies, and preserving effective payload characteristics.
[0029] In some embodiments, the time feature is obtained through the following steps: Determine the mean, standard deviation, and skewness of the time interval between adjacent messages; The mean, standard deviation, and skewness of the time intervals between adjacent messages are used as the time features.
[0030] Specifically, the mean, standard deviation, and skewness of the time intervals between adjacent messages in the same protocol stream are calculated to form a time series feature matrix, which characterizes the temporal behavior and generates time features to represent the differences between adjacent messages.
[0031] In some embodiments, a protocol transition matrix is generated based on the messages within the aforementioned time window to record the transition relationships of adjacent message protocol types, which is used to characterize the behavioral patterns and sequence-dependent transition relationship features at the protocol level.
[0032] In step 230, the load features, the time features, and the transfer relationship features are fused to obtain multimodal fusion features. Here, through... Figure 3 The encoder (i.e., the autoencoder described in this application) in the offline model trainer fuses the load features, the time features, and the transition relationship features to obtain multimodal fusion features.
[0033] In step 240, the encoder in the offline model trainer is trained unsupervised using the multimodal fusion features to obtain a low-dimensional latent vector. The decoder is only used in the training phase to constrain the representation quality.
[0034] In step 250, during the training phase, using Figure 3 The point mapper further compresses the low-dimensional latent vector into an even lower-dimensional point space, and uses the predefined critique points as the cluster centers for normal samples. It should be noted that... Figure 3 The “mapping” in this context refers to the point mapper.
[0035] In step 260, the Euclidean distance between the input feature point and the benchmark point is used as the outlier score, and a preset benchmark threshold is adaptively determined based on the distribution of the pre-prepared validation set; if the discrete score is lower than the benchmark threshold, the time corresponding to the input feature point is determined to be normal, otherwise it is abnormal.
[0036] The following are Figure 3 The structure shown is explained in a flowchart: ① Vehicle traffic is collected from a BroadR-Reach switch; ② A packet capture unit and ③ a feature extractor process the raw data packets (vehicle traffic data as described in this application) to generate features and input them into the encoder; ④ The decoder is used only once when training the encoder; afterwards, the encoder-dot mapper projects each feature as a point; ⑤ The dot determiner uses the training set to determine a baseline point; ⑥ The threshold determiner calculates the outlier score—that is, the distance between the baseline point and the validation set generation point—and determines the anomaly detection threshold; ⑦ The training results are passed to the online anomaly detector; ⑧ The comparator measures the outlier score from the dot mapper; ⑨ The alarm sounds an alarm when the outlier score exceeds the threshold.
[0037] When a normal periodic traffic window W1 (containing continuous AVTP packets, with a window size of 2048) is received, if a baseline has not yet been established, the training process is initiated. The multimodal features extracted from this window (protocol transition matrix, packet payload matrix, and time statistics matrix) are fed into the encoder as input to generate a latent vector. Simultaneously, a point mapper header is appended to this feature and stored in the feature buffer. During the training phase, if other periodic traffic windows W2 and W3 are continuously received, and the buffer capacity meets the requirements, point mapper headers are also added to them and placed in the buffer. After the training process is completed, all feature points in the buffer are clustered together to generate a baseline, and a discrimination threshold for normal traffic is established.
[0038] When an event-type abnormal traffic window E1 is received (e.g., containing a forged time synchronization gPTP message), if the buffer size is sufficient, the stored normal feature points in the buffer, along with the E1 with an added Point Mapper Header, are sent to the detection module to calculate the outlier score and trigger an anomaly alarm; simultaneously, the timer is cleared. When a periodic traffic window W4 is received again, the timer is restarted, and the feature extraction and clustering maintenance of normal traffic continues according to the above process.
[0039] Through the above mechanism, this invention can achieve high-precision identification of zero-day attacks by using periodic traffic to stably train benchmark points and using event-based traffic to trigger detection in a timely manner, while ensuring real-time performance.
[0040] In summary, based on the above design of "multimodal features + autoencoder + point mapping / reference point", this application can achieve a throughput of approximately 9638 features / second on embedded automotive-grade devices; at the same time, since it does not rely on attack sample labels and address fields, it can maintain good generalization detection capability against zero-day attacks, taking into account real-time performance, lightweight design and robustness.
[0041] Please see Figure 4 ,Figure 4 This is a schematic diagram of the structure of the vehicle-mounted Ethernet intrusion detection device provided in the embodiments of this application. The vehicle-mounted Ethernet intrusion detection device is applied to computer equipment, and the vehicle-mounted Ethernet intrusion detection device may include: The receiving unit 401 is used to receive vehicle traffic data collected by the Ethernet traffic acquisition system; The feature extraction unit 402 is used to extract features from the vehicle traffic data to obtain payload features for characterizing a specified byte range of intercepted messages, time features for characterizing the differences between adjacent messages, and transfer relationship features for characterizing protocol-level behavior patterns and sequence dependencies. The feature fusion unit 403 is used to fuse the load features, the time features, and the transfer relationship features to obtain multimodal fusion features; Training unit 404 is used to perform unsupervised training using the multimodal fusion features to obtain a low-dimensional latent vector; Clustering unit 405 is used to compress the low-dimensional latent vector into a low-dimensional point space to obtain clustering centers of normal samples with a preset reference point. The detection unit 406 is used to determine the Euclidean distance between the input feature point and the preset reference point. If the Euclidean distance between the input feature point and the preset reference point is greater than the preset reference threshold, it is determined that there is an abnormal intrusion at the time corresponding to the input feature point.
[0042] Reference Figure 5 , Figure 5 To implement the structural block diagram of a portion of the terminal 140 in this application embodiment, the terminal 140 includes: a radio frequency (RF) circuit 710, a memory 715, an input unit 730, a display unit 740, a sensor 750, an audio circuit 760, a wireless fidelity (WiFi) module 770, a processor 780, and a power supply 790, among other components. Those skilled in the art will understand that... Figure 5 The terminal 140 structure shown does not constitute a limitation on a mobile phone or computer, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.
[0043] The RF circuit 710 can be used to receive and transmit signals during information transmission or calls. In particular, it receives downlink information from the base station and processes it with the processor 780; in addition, it transmits uplink data to the base station.
[0044] The memory 715 can be used to store software programs and modules. The processor 780 executes various terminal functions and vehicle Ethernet intrusion detection processing by running the software programs and modules stored in the memory 715.
[0045] The input unit 730 can be used to receive input numeric or character information, and to generate key signal inputs related to the terminal's settings and function control. Specifically, the input unit 730 may include a touch panel 731 and other input devices 732.
[0046] The display unit 740 can be used to display input or provided information, as well as various menus of the terminal. The display unit 740 may include a display panel 741.
[0047] Audio circuitry 760, speaker 761, and microphone 762 provide an audio interface.
[0048] In this embodiment, the processor 780 included in the terminal 140 can execute the vehicle Ethernet intrusion detection method of the previous embodiment.
[0049] The terminal 140 in this application embodiment includes, but is not limited to, mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, and aircraft. This application embodiment can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving.
[0050] Figure 6 This is a partial structural block diagram of a server 110 implementing an embodiment of this application. The server 110 can vary significantly due to different configurations or performance characteristics, and may include one or more central processing units (CPUs) 822 (e.g., one or more processors) and memory 832, and one or more storage media 830 (e.g., one or more mass storage devices) for storing application programs 842 or data 844. The memory 832 and storage media 830 can be temporary or persistent storage. The program stored in the storage media 830 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the server 110. Furthermore, the CPU 822 may be configured to communicate with the storage media 830 and execute the series of instruction operations in the storage media 830 on the server 110.
[0051] Server 110 may also include one or more power supplies 826, one or more wired or wireless network interfaces 850, one or more input / output interfaces 858, and / or one or more operating systems 841, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.
[0052] The central processing unit 822 in server 110 can be used to execute the vehicle Ethernet intrusion detection method of the present application embodiments.
[0053] This application also provides a computer-readable storage medium for storing program code for executing the vehicle Ethernet intrusion detection methods of the foregoing embodiments.
[0054] This application also provides a computer program product, which includes a computer program. The processor of a computer device reads and executes the computer program, causing the computer device to perform the above-described vehicle Ethernet intrusion detection method.
[0055] Furthermore, the terms “comprising” and “including”, and any variations thereof, are intended to cover non-exclusive inclusion, such that a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or apparatus.
[0056] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.
[0057] It should be understood that in the description of the embodiments of this application, "multiple" means two or more, "greater than", "less than", "exceeding" etc. are understood to exclude the number itself, and "above", "below", "within" etc. are understood to include the number itself.
[0058] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.
[0059] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of this application, depending on actual needs.
[0060] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0061] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0062] It should also be understood that the various implementation methods provided in this application can be combined arbitrarily to achieve different technical effects.
[0063] In the embodiments of this application, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.
[0064] The above is a detailed description of the embodiments of this application. However, this application is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.
Claims
1. A method for detecting intrusion into a vehicle-mounted Ethernet network, characterized in that, The method is applied to an Ethernet real-time observation system, which includes an Ethernet traffic acquisition system, an offline training modeler, and an online anomaly detector. Receive vehicle traffic data collected by the Ethernet traffic acquisition system; Feature extraction is performed on the vehicle traffic data to obtain payload features for characterizing a specified byte range of intercepted messages, time features for characterizing the differences between adjacent messages, and transfer relationship features for characterizing protocol-level behavioral patterns and sequence dependencies. The load features, the time features, and the transfer relationship features are fused to obtain multimodal fusion features; Unsupervised training is performed using the multimodal fusion features to obtain a low-dimensional latent vector; The low-dimensional latent vectors are compressed into a low-dimensional point space to obtain clustering centers for normal samples with preset reference points as the clustering centers. The Euclidean distance between the input feature point and the preset reference point is determined. If the Euclidean distance between the input feature point and the preset reference point is greater than the preset reference threshold, it is determined that there is an abnormal intrusion at the time corresponding to the input feature point.
2. The vehicle-mounted Ethernet intrusion detection method according to claim 1, characterized in that, The load characteristics are obtained through the following steps: Identify each frame of the in-vehicle traffic data; Extract a specified range of message data from each frame, and construct a payload matrix based on the message data; The load characteristics are determined based on the load matrix.
3. The vehicle-mounted Ethernet intrusion detection method according to claim 2, characterized in that, The time feature is obtained through the following steps: Determine the mean, standard deviation, and skewness of the time interval between adjacent messages; The mean, standard deviation, and skewness of the time intervals between adjacent messages are used as the time features.
4. The vehicle-mounted Ethernet intrusion detection method according to claim 3, characterized in that, The offline training modeler includes an autoencoder, which fuses the load features, the temporal features, and the transition relationship features to obtain multimodal fusion features, including: The load features, the time features, and the transfer relationship features are input into the autoencoder to obtain the multimodal fusion features output by the autoencoder.
5. The vehicle-mounted Ethernet intrusion detection method according to claim 4, characterized in that, The offline training modeler further includes a point mapper, wherein compressing the low-dimensional latent vector into a low-dimensional point space includes: The point mapper compresses the low-dimensional latent vector into a low-dimensional point space.
6. The vehicle-mounted Ethernet intrusion detection method according to claim 4, characterized in that, If the Euclidean distance between the input feature point and the preset reference point is greater than a preset reference threshold, then it is determined that there is an abnormal intrusion at the time corresponding to the input feature point, including: The Euclidean distance between the input feature point and the preset benchmark point is used as the outlier score. If the outlier score is greater than the preset benchmark threshold, it is determined that there is an abnormal intrusion at the time corresponding to the input feature point.
7. The vehicle-mounted Ethernet intrusion detection method according to claim 1, characterized in that, The Ethernet traffic acquisition system collects data from the vehicle-mounted switch to obtain the vehicle traffic data.
8. A vehicle-mounted Ethernet intrusion detection device, characterized in that, This device is applied to an Ethernet real-time observation system, which includes an Ethernet traffic acquisition system, an offline training modeler, and an online anomaly detector. The receiving unit is used to receive vehicle traffic data collected by the Ethernet traffic acquisition system; The feature extraction unit is used to extract features from the vehicle traffic data to obtain payload features for characterizing a specified byte range of intercepted messages, time features for characterizing the differences between adjacent messages, and transfer relationship features for characterizing protocol-level behavioral patterns and sequence dependencies. The feature fusion unit is used to fuse the load features, the time features, and the transfer relationship features to obtain multimodal fused features; The training unit is used to perform unsupervised training using the multimodal fusion features to obtain a low-dimensional potential vector; Clustering units are used to compress the low-dimensional latent vectors into a low-dimensional point space to obtain cluster centers for normal samples with a preset reference point as the cluster center. The detection unit is used to determine the Euclidean distance between the input feature point and the preset reference point. If the Euclidean distance between the input feature point and the preset reference point is greater than the preset reference threshold, it is determined that there is an abnormal intrusion at the time corresponding to the input feature point.
9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the vehicle-mounted Ethernet intrusion detection method according to any one of claims 1 to 7.
10. A computer program product, the computer program product comprising a computer program, characterized in that, The computer program is read and executed by the processor of the electronic device, causing the electronic device to perform the vehicle Ethernet intrusion detection method according to any one of claims 1 to 7.