Real-time detection method and system based on CAN bus communication abnormity

Abstract

The invention discloses a real-time detection method and system based on CAN bus communication abnormity, and particularly relates to the technical field of bus communication detection.The system comprises a data acquisition module, a depth feature extraction module, an attention mechanism feature enhancement module and a communication abnormity detection module.The method comprises the steps that message data are acquired in real time through a CAN bus interface card; the method comprises the following steps of: acquiring message data, converting the message data into a binary vector, extracting a hidden feature vector from an input vector through an encoder part of an auto-encoder model, performing weighted enhancement on the hidden feature vector through an attention mechanism layer to obtain a final enhanced feature vector, and obtaining an abnormal probability value of the message data by utilizing a full-connection neural network classifier. According to the method, whether the current CAN message is an abnormal message or not is judged, an alarm signal is generated, an attention mechanism is integrated into the self-encoder, the abnormal signal is effectively amplified, the excellent anti-interference performance is achieved through a training mode of the encoder, and therefore an efficient, accurate and practical solution is provided.

Description

Technical Field

[0001] This invention relates to the field of bus communication detection technology, and more specifically, to a real-time detection method and system for CAN bus communication anomalies. Background Technology

[0002] With the rapid development of automotive intelligence and connectivity, the CAN bus, as the core hub for communication between electronic control units (ECUs) within a vehicle, faces increasingly severe security challenges. Due to the lack of necessary security mechanisms (such as message authentication and encryption) in its initial design, the CAN bus is highly vulnerable to network attacks such as denial-of-service attacks, spoofing, and replay attacks. These attacks can lead to abnormal vehicle functions and seriously threaten the safety of passengers.

[0003] Deep learning technology, especially autoencoders, can automatically learn high-dimensional feature representations of data, providing new ideas for anomaly detection. However, simple autoencoder models often treat all feature dimensions equally when processing CAN bus data, failing to distinguish the contribution of different features to anomaly detection. This results in insufficient perception of key anomaly features, affecting the accuracy and efficiency of detection.

[0004] However, in practical use, it still has some shortcomings. For example, traditional CAN bus anomaly detection methods rely on predefined rules or shallow machine learning models, which are difficult to effectively learn the complex spatiotemporal dependencies and deep feature patterns in CAN bus data. Especially for carefully constructed and highly disguised attack packets, its detection capability is often inadequate. Traditional machine learning methods rely heavily on manual feature engineering, and the sufficiency of feature extraction directly restricts the detection performance. Moreover, it is not effective in detecting small and latent attacks. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a real-time detection method and system for CAN bus communication anomalies, which are used to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a real-time detection system for CAN bus communication anomalies, comprising: Data acquisition module: Used to acquire raw hexadecimal message data on the CAN bus in real time through the CAN bus interface card, and convert the message data into a fixed-length binary vector to form the model input dataset.

[0007] Deep feature extraction module: used to input the binary vector into a pre-trained multi-layer denoising autoencoder model. The encoder part of the autoencoder model performs dimensionality reduction and compression on the input vector, extracts hidden feature representations, and outputs hidden feature vectors.

[0008] Attention mechanism feature enhancement module: used to calculate the corresponding attention weights on the hidden feature vectors through the attention mechanism layer, and to perform weighted enhancement on the feature vectors to obtain the final enhanced feature vector of the message data.

[0009] Communication anomaly detection module: used to input the enhanced feature vector into a fully connected neural network classifier to obtain the anomaly probability value of the message data, determine whether the current CAN message is an abnormal message, and generate an alarm signal.

[0010] Preferably, the data acquisition module specifically comprises: Connect the CAN bus interface card to the system host, initialize the interface card driver, establish a communication link with the operating system, and obtain the device handle of the interface card through the driver for subsequent data read and write operations. The driver continuously receives each frame of raw hexadecimal message data from the CAN bus through API functions provided by the driver, and records the metadata of each frame, including the receiving timestamp, frame type, and extended frame flag. Extract the valid data field from each frame of raw hexadecimal message data, and convert each hexadecimal byte in the valid data field into a binary number to form a binary number of uniform length; The binary number is converted into a binary vector, where each element is either 0 or 1. After each frame of a message is received and converted, its corresponding binary vector is stored in the buffer in the order of the received timestamp.

[0011] Preferably, the deep feature extraction module specifically comprises: The multilayer denoising autoencoder model consists of two parts: an encoder and a decoder. The encoder is composed of an input layer, a first hidden layer, a second hidden layer, and an encoding layer. The number of neurons in the input layer is the same as the dimension of the binary vector. The decoder is the inverse structure of the encoder, consisting of a decoding layer, a first anti-hidden layer, a second anti-hidden layer, and an output layer. The number of neurons in each layer is the same as the number of neurons in the encoder layer. The number of neurons in the first anti-hidden layer is the same as the number of neurons in the second hidden layer of the encoder. The number of neurons in the second anti-hidden layer is the same as the number of neurons in the first hidden layer of the encoder. The number of neurons in the output layer is the same as the number of neurons in the input layer. It receives binary vector input to the input layer of a pre-trained multi-layer denoising autoencoder model; The dimensionality reduction and compression are as follows: The binary vector of the input layer is multiplied by the weight matrix of the first hidden layer, and the bias vector of the first hidden layer is added. After processing by the activation function, the output of the first hidden layer is obtained. The output of the first hidden layer is multiplied by the weight matrix of the second hidden layer, and the bias vector of the second hidden layer is added. After processing by the activation function, the output of the second hidden layer is obtained. The output of the second hidden layer is multiplied by the weight matrix of the encoding layer, and the bias vector of the encoding layer is added. After processing by the activation function, the output of the encoding layer is obtained. The output of the encoder's encoding layer is extracted, which is the hidden feature vector.

[0012] Preferably, the attention mechanism feature enhancement module specifically comprises: Receive the hidden feature vector output by the deep feature extraction module; If the dimension of the hidden feature vector does not match the input dimension required by the attention mechanism layer, a linear transformation layer is used to perform dimension transformation; the linear transformation layer contains a preset parameter matrix, and the hidden feature vector is multiplied by the parameter matrix to obtain the transformed feature vector; The dimension transformation formula is: ,in, Represented as the transformed feature vector, Represented as hidden feature vectors, Represented as a linear transformation parameter matrix; Specifically, the dimensions of the hidden feature vectors are adjusted through dimensionality transformation to meet the input requirements of the attention mechanism layer; Three independent linear transformation layers are used to generate the query matrix, key matrix, and value matrix, respectively. Each linear transformation layer has its own parameter matrix. The transformed feature vector is input into these three linear transformation layers to obtain the query matrix, key matrix, and value matrix in sequence. The formula for the query matrix is: ,in, Represented as a query matrix, Represented as the transformed feature vector, Represented as a query parameter matrix, Represented as a query bias vector; The formula for the bond matrix is: ,in, Represented as a key matrix, Represented as a key parameter matrix, Represented as a key bias vector; The formula for the value matrix is: ,in, Represented as a value matrix, Represented as a value parameter matrix, Represented as a value bias vector; Specifically, through three independent linear transformations, the transformed feature vectors are mapped to three different subspaces, which are used for subsequent attention score calculation and feature weighting, respectively. The attention score is obtained by performing a dot product operation between the query matrix and the key matrix. The attention score is then normalized using the Softmax function to obtain the normalized attention weight. The formula for the attention score is: ,in, Represented as attention score, Represented as a query matrix with dimension (1, k), It is represented as the transpose of the key matrix with dimension (k, 1); Specifically, the raw score of feature importance is obtained by calculating the similarity between the query and the key; The normalized attention weight formula is as follows: ,in, Represented as attention weights, Represented as a normalization function; Based on the calculated attention weights, the attention weights are multiplied by each element in the value matrix, and then all the multiplication results are summed to obtain the weighted feature vector. The formula for the weighted eigenvector is: ,in, Represented as a weighted eigenvector, Represented as a value matrix, Represented as attention weights; The feature vectors obtained after dimensionality transformation by the linear transformation layer and the weighted feature vectors are fused to obtain the final enhanced feature vector of the message data. ,in, This is represented as an enhanced feature vector.

[0013] Preferably, the communication anomaly detection module specifically comprises: A fully connected neural network classifier consists of an input layer, hidden layers, and an output layer: The number of neurons in the input layer is the same as the dimension of the enhanced feature vector, and it is used to receive the enhanced feature vector. The first hidden layer performs matrix multiplication on the enhanced feature vector of the input layer and the weight matrix of the first hidden layer. The result is added to the bias vector of the first hidden layer, and then processed by the activation function to obtain the output of the first hidden layer. The second hidden layer performs matrix multiplication on the output of the first hidden layer and the weight matrix of the second hidden layer. The result is added to the bias vector of the second hidden layer and then processed by an activation function to obtain the output of the second hidden layer. The output layer performs matrix multiplication on the output of the second hidden layer and the weight matrix of the output layer. The result is added to the bias vector of the output layer, and then processed by the Sigmoid activation function to obtain the output of the output layer, which is the probability value of the message data being an abnormal message. The Sigmoid function can map the output value to an abnormal probability value between 0 and 1. The abnormal probability value of the message data output by the fully connected neural network classifier is compared with a preset abnormal probability value threshold. If the abnormal probability value is greater than the preset abnormal probability value threshold, the current CAN message is determined to be an abnormal message; if the abnormal probability value is less than or equal to the preset abnormal probability value threshold, it is determined to be a normal message. The preset anomaly probability threshold can be determined through statistical analysis based on the detection results of a large number of normal and abnormal messages. An alarm signal is generated when the current CAN message is determined to be an abnormal message.

[0014] A preferred method for real-time detection of CAN bus communication anomalies includes the following steps: Step S01: Used to collect raw hexadecimal message data on the CAN bus in real time through the CAN bus interface card, and convert the message data into a fixed-length binary vector to form the model input dataset; Step S02: The binary vector is input into a pre-trained multilayer denoising autoencoder model. The encoder part of the autoencoder model performs dimensionality reduction and compression on the input vector, extracts hidden feature representations, and outputs hidden feature vectors. Step S03: Calculate the corresponding attention weights for the hidden feature vectors through the attention mechanism layer, perform weighted enhancement on the feature vectors, and obtain the final enhanced feature vector of the message data; Step S04: Input the enhanced feature vector into a fully connected neural network classifier to obtain the abnormal probability value of the message data, determine whether the current CAN message is an abnormal message, and generate an alarm signal.

[0015] The technical effects and advantages of this invention are as follows: 1. This invention provides a real-time detection method and system for CAN bus communication anomalies. It acquires raw hexadecimal message data from the CAN bus in real time via a CAN bus interface card, converts the message data into fixed-length binary vectors, and inputs these binary vectors into a pre-trained multi-layer denoising autoencoder model. The encoder part of the autoencoder model performs dimensionality reduction and compression on the input vectors, extracts hidden feature representations, and outputs hidden feature vectors. An attention mechanism layer applies attention weights corresponding to the hidden feature vectors to weighted enhance the feature vectors, resulting in the final enhanced feature vector of the message data. This enhanced feature vector is then input into a fully connected neural network classifier to obtain the anomaly probability value of the message data. The system determines whether the current CAN message is an abnormal message and generates an alarm signal. By integrating the attention mechanism into the autoencoder, the model can autonomously focus on the most critical feature dimensions for anomaly detection, effectively amplifying abnormal signals and suppressing irrelevant noise, significantly improving the detection sensitivity for minor anomalies and new types of attacks. The encoder training method exhibits excellent anti-interference performance, providing an efficient, accurate, and practical solution for CAN bus security. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the structure of the real-time detection system for CAN bus communication anomalies according to the present invention.

[0017] Figure 2 This is a flowchart illustrating the real-time detection method for CAN bus communication anomalies according to the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Please see Figure 1 As shown, the present invention provides a real-time detection method and system for CAN bus communication anomalies, including a data acquisition module, a deep feature extraction module, an attention mechanism feature enhancement module, and a communication anomaly detection module.

[0020] The data acquisition module is connected to the deep feature extraction module, the deep feature extraction module is connected to the attention mechanism feature enhancement module, and the attention mechanism feature enhancement module is connected to the communication anomaly detection module.

[0021] Data acquisition module: Used to acquire raw hexadecimal message data on the CAN bus in real time through the CAN bus interface card, and convert the message data into a fixed-length binary vector to form the model input dataset.

[0022] In one possible design, the data acquisition module specifically comprises: Connect the CAN bus interface card to the system host, initialize the interface card driver, establish a communication link with the operating system, and obtain the device handle of the interface card through the driver for subsequent data read and write operations. The driver continuously receives each frame of raw hexadecimal message data from the CAN bus through API functions provided by the driver, and records the metadata of each frame, including the receiving timestamp, frame type, and extended frame flag. Extract the valid data field from each frame of raw hexadecimal message data, and convert each hexadecimal byte in the valid data field into a binary number to form a binary number of uniform length; The binary number is converted into a binary vector, where each element is either 0 or 1. After each frame of a message is received and converted, its corresponding binary vector is stored in the buffer in the order of the received timestamp.

[0023] Deep feature extraction module: used to input the binary vector into a pre-trained multi-layer denoising autoencoder model. The encoder part of the autoencoder model performs dimensionality reduction and compression on the input vector, extracts hidden feature representations, and outputs hidden feature vectors.

[0024] In one possible design, the deep feature extraction module specifically comprises: The multilayer denoising autoencoder model consists of two parts: an encoder and a decoder. The encoder is composed of an input layer, a first hidden layer, a second hidden layer, and an encoding layer. The number of neurons in the input layer is the same as the dimension of the binary vector. For example, if the binary vector is 64-dimensional, then the input layer has 64 neurons. The decoder is the inverse structure of the encoder, consisting of a decoding layer, a first anti-hidden layer, a second anti-hidden layer, and an output layer. The number of neurons in each layer is the same as the number of neurons in the encoding layer of the encoder. The number of neurons in the first anti-hidden layer is the same as the number of neurons in the second hidden layer of the encoder. The number of neurons in the second anti-hidden layer is the same as the number of neurons in the first hidden layer of the encoder. The number of neurons in the output layer is the same as the number of neurons in the input layer. It receives binary vector input to the input layer of a pre-trained multi-layer denoising autoencoder model; The dimensionality reduction and compression are as follows: The binary vector of the input layer is multiplied by the weight matrix of the first hidden layer, and the bias vector of the first hidden layer is added. After processing by the activation function, the output of the first hidden layer is obtained. The output of the first hidden layer is multiplied by the weight matrix of the second hidden layer, and the bias vector of the second hidden layer is added. After processing by the activation function, the output of the second hidden layer is obtained. The output of the second hidden layer is multiplied by the weight matrix of the encoding layer, and the bias vector of the encoding layer is added. After processing by the activation function, the output of the encoding layer is obtained. The output of the encoder's encoding layer is extracted, which is the hidden feature vector.

[0025] Attention mechanism feature enhancement module: used to calculate the corresponding attention weights on the hidden feature vectors through the attention mechanism layer, and to perform weighted enhancement on the feature vectors to obtain the final enhanced feature vector of the message data.

[0026] In one possible design, the attention mechanism feature enhancement module specifically comprises: Receive the hidden feature vector output by the deep feature extraction module; If the dimension of the hidden feature vector does not match the input dimension required by the attention mechanism layer, a linear transformation layer is used to perform dimension transformation; the linear transformation layer contains a preset parameter matrix, and the hidden feature vector is multiplied by the parameter matrix to obtain the transformed feature vector; The dimension transformation formula is: ,in, Represented as the transformed feature vector, Represented as hidden feature vectors, Represented as a linear transformation parameter matrix; Specifically, the dimensions of the hidden feature vectors are adjusted through dimensionality transformation to meet the input requirements of the attention mechanism layer; Three independent linear transformation layers are used to generate the query matrix, key matrix, and value matrix, respectively. Each linear transformation layer has its own parameter matrix. The transformed feature vector is input into these three linear transformation layers to obtain the query matrix, key matrix, and value matrix in sequence. The formula for the query matrix is: ,in, Represented as a query matrix, Represented as the transformed feature vector, Represented as a query parameter matrix, Represented as a query bias vector; The formula for the bond matrix is: ,in, Represented as a key matrix, Represented as a key parameter matrix, Represented as a key bias vector; The formula for the value matrix is: ,in, Represented as a value matrix, Represented as a value parameter matrix, Represented as a value bias vector; Specifically, through three independent linear transformations, the transformed feature vectors are mapped to three different subspaces, which are used for subsequent attention score calculation and feature weighting, respectively. The attention score is obtained by performing a dot product operation between the query matrix and the key matrix. The attention score is then normalized using the Softmax function to obtain the normalized attention weight. The formula for the attention score is: ,in, Represented as attention score, Represented as a query matrix with dimension (1, k), It is represented as the transpose of the key matrix with dimension (k, 1); Specifically, the raw score of feature importance is obtained by calculating the similarity between the query and the key; The normalized attention weight formula is as follows: ,in, This is represented as attention weights, with values ​​ranging from (0,1). Represented as a normalization function; Based on the calculated attention weights, the attention weights are multiplied by each element in the value matrix, and then all the multiplication results are summed to obtain the weighted feature vector. The formula for the weighted eigenvector is: ,in, Represented as a weighted eigenvector, Represented as a value matrix, Represented as attention weights; The feature vectors obtained after dimensionality transformation by the linear transformation layer and the weighted feature vectors are fused to obtain the final enhanced feature vector of the message data. ,in, This is represented as an enhanced feature vector.

[0027] Communication anomaly detection module: used to input the enhanced feature vector into a fully connected neural network classifier to obtain the anomaly probability value of the message data, determine whether the current CAN message is an abnormal message, and generate an alarm signal.

[0028] In one possible design, the communication anomaly detection module specifically comprises: A fully connected neural network classifier consists of an input layer, hidden layers, and an output layer: The number of neurons in the input layer is the same as the dimension of the enhanced feature vector, and it is used to receive the enhanced feature vector. The first hidden layer performs matrix multiplication on the enhanced feature vector of the input layer and the weight matrix of the first hidden layer. The result is added to the bias vector of the first hidden layer, and then processed by the activation function to obtain the output of the first hidden layer. The second hidden layer performs matrix multiplication on the output of the first hidden layer and the weight matrix of the second hidden layer. The result is added to the bias vector of the second hidden layer and then processed by an activation function to obtain the output of the second hidden layer. The output layer performs matrix multiplication on the output of the second hidden layer and the weight matrix of the output layer. The result is added to the bias vector of the output layer, and then processed by the Sigmoid activation function to obtain the output of the output layer, which is the probability value of the message data being an abnormal message. The Sigmoid function can map the output value to an abnormal probability value between 0 and 1. The abnormal probability value of the message data output by the fully connected neural network classifier is compared with a preset abnormal probability value threshold. If the abnormal probability value is greater than the preset abnormal probability value threshold, the current CAN message is determined to be an abnormal message; if the abnormal probability value is less than or equal to the preset abnormal probability value threshold, it is determined to be a normal message. The preset anomaly probability threshold can be determined through statistical analysis based on the detection results of a large number of normal and abnormal messages. An alarm signal is generated when the current CAN message is determined to be an abnormal message.

[0029] Please see Figure 2 As shown, this invention provides a real-time detection method for CAN bus communication anomalies, including the following steps: Step S01: Used to collect raw hexadecimal message data on the CAN bus in real time through the CAN bus interface card, and convert the message data into a fixed-length binary vector to form the model input dataset; Step S02: The binary vector is input into a pre-trained multilayer denoising autoencoder model. The encoder part of the autoencoder model performs dimensionality reduction and compression on the input vector, extracts hidden feature representations, and outputs hidden feature vectors. Step S03: Calculate the corresponding attention weights for the hidden feature vectors through the attention mechanism layer, perform weighted enhancement on the feature vectors, and obtain the final enhanced feature vector of the message data; Step S04: Input the enhanced feature vector into a fully connected neural network classifier to obtain the abnormal probability value of the message data, determine whether the current CAN message is an abnormal message, and generate an alarm signal.

[0030] In this embodiment, it should be specifically explained that the present invention acquires raw hexadecimal message data on the CAN bus in real time through a CAN bus interface card, converts the message data into a fixed-length binary vector, and inputs the binary vector into a pre-trained multi-layer denoising autoencoder model. The encoder part of the autoencoder model performs dimensionality reduction and compression on the input vector, extracts hidden feature representations, and outputs hidden feature vectors. Through an attention mechanism layer, the attention weights corresponding to the hidden feature vectors are applied to weighted enhancement of the feature vectors, resulting in the final enhanced feature vector of the message data. The enhanced feature vector is input into a fully connected neural network classifier to obtain the anomaly probability value of the message data, determine whether the current CAN message is an abnormal message, and generate an alarm signal. The attention mechanism is integrated into the autoencoder, which enables the model to autonomously focus on the most critical feature dimensions for anomaly detection, effectively amplifying abnormal signals, suppressing irrelevant noise, and significantly improving the detection sensitivity for minor anomalies and new attacks. The encoder training method has excellent anti-interference performance, providing an efficient, accurate, and practical solution for CAN bus security.

[0031] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A real-time detection system for CAN bus communication anomalies, characterized in that, include: Data acquisition module: used to acquire raw hexadecimal message data on the CAN bus in real time through the CAN bus interface card, and convert the message data into a fixed-length binary vector to form the model input dataset; Deep feature extraction module: used to input the binary vector into a pre-trained multi-layer denoising autoencoder model, wherein the encoder part of the autoencoder model performs dimensionality reduction and compression on the input vector, extracts hidden feature representations, and outputs hidden feature vectors; Attention mechanism feature enhancement module: used to calculate the corresponding attention weights on the hidden feature vectors through the attention mechanism layer, and to perform weighted enhancement on the feature vectors to obtain the final enhanced feature vector of the message data; Communication anomaly detection module: used to input the enhanced feature vector into a fully connected neural network classifier to obtain the anomaly probability value of the message data, determine whether the current CAN message is an abnormal message, and generate an alarm signal.

2. The real-time detection system for CAN bus communication anomalies according to claim 1, characterized in that: The data acquisition module is specifically: Connect the CAN bus interface card to the system host, initialize the interface card driver, establish a communication link with the operating system, and obtain the device handle of the interface card through the driver for subsequent data read and write operations. The driver continuously receives each frame of raw hexadecimal message data from the CAN bus through API functions provided by the driver, and records the metadata of each frame, including the receiving timestamp, frame type, and extended frame flag. Extract the valid data field from each frame of raw hexadecimal message data, and convert each hexadecimal byte in the valid data field into a binary number to form a binary number of uniform length; The binary number is converted into a binary vector, where each element is either 0 or 1. After each frame of a message is received and converted, its corresponding binary vector is stored in the buffer in the order of the received timestamp.

3. The real-time detection system for CAN bus communication anomalies according to claim 1, characterized in that: The deep feature extraction module is specifically as follows: The multilayer denoising autoencoder model consists of two parts: an encoder and a decoder. The encoder is composed of an input layer, a first hidden layer, a second hidden layer, and an encoding layer. The number of neurons in the input layer is the same as the dimension of the binary vector. The decoder is the inverse structure of the encoder, consisting of a decoding layer, a first anti-hidden layer, a second anti-hidden layer, and an output layer. The number of neurons in each layer is the same as the number of neurons in the encoding layer of the encoder. The number of neurons in the first hidden layer is the same as the number of neurons in the second hidden layer of the encoder. The number of neurons in the second hidden layer is the same as the number of neurons in the first hidden layer of the encoder, and the number of neurons in the output layer is the same as the number of neurons in the input layer. It receives binary vector input to the input layer of a pre-trained multi-layer denoising autoencoder model; The dimensionality reduction and compression are as follows: The binary vector of the input layer is multiplied by the weight matrix of the first hidden layer, and the bias vector of the first hidden layer is added. Then, after being processed by the activation function, the output of the first hidden layer is obtained. The output of the first hidden layer is multiplied by the weight matrix of the second hidden layer, and the bias vector of the second hidden layer is added. After processing by the activation function, the output of the second hidden layer is obtained. The output of the second hidden layer is multiplied by the weight matrix of the encoding layer, and the bias vector of the encoding layer is added. After processing by the activation function, the output of the encoding layer is obtained. The output of the encoder's encoding layer is extracted, which is the hidden feature vector.

4. The real-time detection system for CAN bus communication anomalies according to claim 1, characterized in that: The attention mechanism feature enhancement module specifically includes: Receive the hidden feature vector output by the deep feature extraction module; If the dimension of the hidden feature vector does not match the input dimension required by the attention mechanism layer, a linear transformation layer is used to perform dimension transformation; the linear transformation layer contains a preset parameter matrix, and the hidden feature vector is multiplied by the parameter matrix to obtain the transformed feature vector; The dimension transformation formula is: ,in, Represented as the transformed feature vector, Represented as hidden feature vectors, Represented as a linear transformation parameter matrix; Specifically, the dimensions of the hidden feature vectors are adjusted through dimensionality transformation to meet the input requirements of the attention mechanism layer; Three independent linear transformation layers are used to generate the query matrix, key matrix, and value matrix, respectively. Each linear transformation layer has its own parameter matrix. The transformed feature vector is input into these three linear transformation layers to obtain the query matrix, key matrix, and value matrix in sequence. The formula for the query matrix is: ,in, Represented as a query matrix, Represented as the transformed feature vector, Represented as a query parameter matrix, Represented as a query bias vector; The formula for the bond matrix is: ,in, Represented as a key matrix, Represented as a key parameter matrix, Represented as a key bias vector; The formula for the value matrix is: ,in, Represented as a value matrix, Represented as a value parameter matrix, Represented as a value bias vector; Specifically, through three independent linear transformations, the transformed feature vectors are mapped to three different subspaces, which are used for subsequent attention score calculation and feature weighting, respectively. The attention score is obtained by performing a dot product operation between the query matrix and the key matrix. The attention score is then normalized using the Softmax function to obtain the normalized attention weight. The formula for the attention score is: ,in, Represented as attention score, Represented as a query matrix, It is represented as the transpose of the key matrix; Specifically, the raw score of feature importance is obtained by calculating the similarity between the query and the key; The normalized attention weight formula is as follows: ,in, Represented as attention weights, Represented as a normalization function; Based on the calculated attention weights, the attention weights are multiplied by each element in the value matrix, and then all the multiplication results are summed to obtain the weighted feature vector. The formula for the weighted eigenvector is: ,in, Represented as a weighted eigenvector, Represented as a value matrix, Represented as attention weights; The feature vectors obtained after dimensionality transformation by the linear transformation layer and the weighted feature vectors are fused to obtain the final enhanced feature vector of the message data. ,in, This is represented as an enhanced feature vector.

5. The real-time detection system for CAN bus communication anomalies according to claim 1, characterized in that: The communication anomaly detection module is specifically as follows: A fully connected neural network classifier consists of an input layer, hidden layers, and an output layer: The number of neurons in the input layer is the same as the dimension of the enhanced feature vector, and it is used to receive the enhanced feature vector. The first hidden layer performs matrix multiplication on the enhanced feature vector of the input layer and the weight matrix of the first hidden layer. The result is added to the bias vector of the first hidden layer, and then processed by the activation function to obtain the output of the first hidden layer. The second hidden layer performs matrix multiplication on the output of the first hidden layer and the weight matrix of the second hidden layer. The result is added to the bias vector of the second hidden layer and then processed by an activation function to obtain the output of the second hidden layer. The output layer performs matrix multiplication on the output of the second hidden layer and the weight matrix of the output layer. The result is added to the bias vector of the output layer and then processed by the Sigmoid activation function to obtain the output of the output layer, which is the probability value that the message data is an abnormal message. The Sigmoid function maps output values ​​to anomaly probability values ​​between 0 and 1; The abnormal probability value of the message data output by the fully connected neural network classifier is compared with a preset abnormal probability value threshold. If the abnormal probability value is greater than the preset abnormal probability value threshold, the current CAN message is determined to be an abnormal message; if the abnormal probability value is less than or equal to the preset abnormal probability value threshold, it is determined to be a normal message. The preset anomaly probability threshold can be determined through statistical analysis based on the detection results of a large number of normal and abnormal messages. An alarm signal is generated when the current CAN message is determined to be an abnormal message.

6. A real-time detection method for CAN bus communication anomalies, using the real-time detection system for CAN bus communication anomalies as described in any one of claims 1-5, characterized in that: Includes the following steps: Step S01: Used to collect raw hexadecimal message data on the CAN bus in real time through the CAN bus interface card, and convert the message data into a fixed-length binary vector to form the model input dataset; Step S02: The binary vector is input into a pre-trained multilayer denoising autoencoder model. The encoder part of the autoencoder model performs dimensionality reduction and compression on the input vector, extracts hidden feature representations, and outputs hidden feature vectors. Step S03: Calculate the corresponding attention weights for the hidden feature vectors through the attention mechanism layer, perform weighted enhancement on the feature vectors, and obtain the final enhanced feature vector of the message data; Step S04: Input the enhanced feature vector into a fully connected neural network classifier to obtain the abnormal probability value of the message data, determine whether the current CAN message is an abnormal message, and generate an alarm signal.

Images