Intranet encryption malicious traffic identification method and system based on attention mechanism

Abstract

The invention belongs to the technical field of intranet security, and discloses an intranet encryption malicious traffic identification method and system based on an attention mechanism, and the method comprises the steps: carrying out the encryption processing of original CAN bus data through employing an XTEA lightweight algorithm, and simulating a real intranet encryption environment; the encrypted data are converted into two-dimensional image features and sequential sequence features at the same time, efficient spatial feature extraction is performed by using an optimized CNN structure, and the sequential features are captured by combining a GRU network, a self-attention mechanism and a Transform encoder; and training is carried out through feature fusion, so that accurate recognition of different types of attacks is realized. According to the method, on the premise of not depending on hardware, high-precision identification is realized under the condition that malicious traffic encrypted by the in-vehicle network does not need to be decrypted, the requirements of the in-vehicle network on real-time performance and resource consumption are met, and meanwhile, high-precision identification capability is still kept in the face of various attacks.

Description

TECHNICAL FIELD

[0001] The present application belongs to but is not limited to the field of in-vehicle network security technology, and particularly relates to an in-vehicle network encrypted malicious traffic identification method and system based on an attention mechanism. BACKGROUND

[0002] In the Internet of Vehicles environment, attackers can intrude into the in-vehicle network through various ways, such as physical interfaces (OBD-II port), wireless communication (Bluetooth, Wi-Fi), or remote connection (cellular network), and launch various malicious behaviors such as Denial of Service (DoS), Fuzzy attack, Gear attack, and RPM attack. These attacks not only cause abnormal vehicle functions, such as instrument panel display errors, power system response delays, but also can endanger driving safety and personal safety, such as sudden brake failure or acceleration. Therefore, developing an efficient Intrusion Detection System (IDS) is crucial to ensuring the security of the Internet of Vehicles. Traditional rule-based and signature-based IDS performs poorly in the face of unknown attacks and complex attack patterns, making it difficult to adapt to the rapid evolution of attack methods in the Internet of Vehicles environment. In recent years, with the development of deep learning technology, IDS based on deep learning has shown superior performance, which can automatically learn data features and identify complex attack patterns. However, existing deep learning methods face challenges when dealing with encrypted traffic, because encryption can mask the original features of CAN data frames, making it difficult for traditional feature extraction methods to work effectively. In addition, the real-time performance, resource consumption, and detection accuracy of the IDS in the vehicle environment are all high requirements, which further increases the design difficulty.

[0003] Existing Intrusion Detection Systems (IDS) are mainly designed for plaintext CAN bus data. When facing encrypted traffic, they usually need to be decrypted first and then analyzed, which not only significantly increases the computational overhead, but also prolongs the detection response time, making it difficult to meet the strict requirements of real-time performance in the vehicle environment. The current detection of encrypted malicious traffic in the in-vehicle network has the problems of low detection accuracy, limited generalization ability for multiple attack types, and the need for additional hardware monitoring devices.

[0004] In view of the above analysis, the existing technical problems of the prior art that need to be solved urgently are:

[0005] (1) Difficulty in extracting features from encrypted traffic: Encryption technology obscures the original features of CAN data frames, making traditional detection methods based on CAN ID, data content, and other plaintext features ineffective. Without decryption, how to extract effective and useful features for intrusion detection from encrypted traffic is a major difficulty;

[0006] (2) The balance between real-time performance and resource consumption: The vehicle environment has extremely high requirements for the real-time performance of IDS. Any detection delay may lead to serious consequences. At the same time, the computing resources of vehicle ECUs are usually limited, and designing an efficient and low-power detection model is a challenge.

[0007] (3) Diversity of attack types and generalization ability: Attackers launch a variety of malicious behaviors, including DoS, Fuzzy, Gear, RPM and other attacks. Existing systems have limited generalization ability when dealing with multiple attack types. Designing a model that can identify multiple known and unknown attack patterns and has good generalization ability requires in-depth research;

[0008] (4) No additional hardware dependency: Existing methods may require additional hardware monitoring equipment to assist in detection, which increases costs and deployment complexity. Achieving efficient and accurate intrusion detection solely through the software layer without relying on additional hardware is a challenge.

[0009] (5) Achieving high accuracy: While meeting the above-mentioned limitations such as real-time performance and low resource consumption, maintaining high detection accuracy, especially for encrypted traffic, is a major challenge, because any false alarm or missed alarm may have a negative impact on vehicle function and driving safety.

[0010] Existing technology discloses a malicious activity detection system for automotive internal network CAN bus. This system includes a threat monitoring and forensics platform capable of collecting CAN bus data, establishing a behavioral baseline model, and analyzing deviations from the baseline to detect potential malicious attacks. The system can promptly notify the driver or service provider upon detecting anomalies and supports remote updates to continuously improve its detection capabilities.

[0011] 1. Relies on behavioral baseline models and lacks multimodal fusion capabilities.

[0012] This system primarily relies on establishing and updating a baseline of CAN bus data for anomaly detection, which is a single-modal analysis (time series statistics only). Its generalization ability is limited when faced with encrypted CAN bus data or highly complex attack patterns, and it cannot fully exploit multi-dimensional features (such as structured image features or spatial distribution patterns).

[0013] 2. Insufficient real-time performance and data format compatibility

[0014] While the system supports real-time monitoring and alerts, its data processing workflow is more focused on analysis on cloud platforms or remote endpoints, lacking the capability for local feature extraction and fusion processing of encrypted CAN data. This makes it difficult to deploy lightweight, real-time edge applications. Furthermore, it lacks the ability to perform parallel modeling of image and sequence modalities, hindering its ability to improve the accuracy of identifying complex intrusion behaviors. Summary of the Invention

[0015] To address the problems existing in the prior art, this invention provides a method and system for identifying encrypted malicious traffic in in-vehicle networks based on an attention mechanism.

[0016] This invention is implemented as follows: a method for identifying malicious traffic in an in-vehicle network based on an attention mechanism, characterized in that the method specifically includes:

[0017] S1: Data preprocessing. Before using the Car-Hacking dataset for training the malicious traffic identification module, a series of data preprocessing operations are performed. The XTEA lightweight algorithm is used to encrypt the original CAN bus data, and the encrypted data is converted into two-dimensional image features and time sequence features at the same time.

[0018] S2: Feature extraction. Design a CNN-Transformer hybrid model to achieve spatial feature extraction and temporal feature extraction of the data through dual-branch parallel processing.

[0019] S3: Feature fusion, which integrates image features and temporal features, and achieves comprehensive characterization of CAN bus data through multi-stage processing;

[0020] S4: Model training and classification, feeding the fused features into a multilayer perceptron for model training, and determining whether there is intrusion behavior in the current traffic data.

[0021] Furthermore, step S1, the preprocessing operation, includes:

[0022] (1) Data cleaning

[0023] Remove invalid rows with missing values, remove possible header rows by detecting the content of the first row, convert timestamps to numeric types and sort them by time, extract key columns and convert hexadecimal data to integers through type conversion;

[0024] (2) Data encryption

[0025] The preprocessed data is encrypted using the XTEA method. The preprocessed 64-bit plaintext data is evenly divided into a 32-bit left half v0 and a right half v1, constructing an initial data pair (v0, v1). The 128-bit key is parsed into four 32-bit subkeys k0, k1, k2, k3, and a fixed constant δ = 0x9e3779b9 related to the golden ratio is introduced as an iteration parameter. Based on the iteration rules of the Feistel network, data obfuscation is achieved through 32 rounds of encryption operations. In the i-th iteration, let sum = i × δ (using modulo-2^32 arithmetic), according to the formula:

[0026]

[0027] Update the left half of the formula.

[0028]

[0029] Part of the data is shuffled by circularly shifting left by 4 bits, circularly shifting right by 5 bits, adding the result to the original data, and then performing an XOR operation. Finally, the result is ANDed with (sum+k). sum&3 If the format is incorrect, perform an XOR operation to incorporate the subkey into the data, and then apply the formula.

[0030]

[0031] Update the right half;

[0032] After 32 rounds of iteration, the final (v0,v1) sub-blocks are merged into 64-bit ciphertext;

[0033] (3) Feature transformation

[0034] Two feature extraction methods are employed: First, the encrypted data is converted into a 21×21×3 RGB image. Firstly, a certain amount of data required to construct the image is extracted. Then, the data is reshaped into a 9×9×3 image format and enlarged to a size of 21×21×3 using bilinear interpolation. Finally, all image data is standardized to have a mean of 0 and a standard deviation of 1, resulting in preprocessed data suitable for neural network model input. Second, based on the sliding window statistical method, temporal features of the encrypted data are constructed for training the Transformer network. By setting the sliding window size and step size, sliding statistics are performed on the encrypted data to extract statistical features such as mean, variance, and frequency within the window, serving as temporal features.

[0035] Furthermore, the spatial feature extraction in S2 employs a three-dimensional convolutional kernel design. Through batch normalization, ReLU function, and pooling layers, it is able to handle local spatial transformations. The convolutional block architecture is as follows:

[0036] (1) First stage

[0037] A 3×3 convolutional kernel group (number of channels C=64) is used to perform feature extraction based on a local sliding window mechanism. After the convolution operation, a 2×2 max pooling operation is performed, using the downsampling formula:

[0038]

[0039] l represents the number of layers in the neural network, i represents the row index, j represents the column index, and m and n are used to index the position within the pooling window in the input features, compressing the feature map size from 21×21 to 10×10.

[0040] (2) Second stage

[0041] A 128-channel convolutional layer is deployed to capture intermediate semantic features, and pooling operations are used to further compress the feature map size to 5×5.

[0042] (3) Third stage

[0043] High-level semantic feature learning is performed using 256-channel convolutional layers, and finally, a global feature vector with a dimension of 256 is output through average pooling.

[0044]

[0045] i and j represent the values ​​of the output feature map at the position, X is the input feature map, k is the size of the pooling window, m and n are used to index the position within the 2×2 pooling window of the input feature map, and s is the stride, which controls the sliding distance of the window.

[0046] Furthermore, the temporal feature extraction in S2 includes:

[0047] (1) Sequence embedding and positional encoding

[0048] Application scenario: Processing CAN bus timing sequences of length L=10, requiring preservation of sequence information to detect timing anomalies such as replay attacks. The technical process is as follows:

[0049] Feature embedding: Mapping the original features (dimension D) to the Transformer feature space (dimension d) through a linear layer. model =128), the specific formula is:

[0050]

[0051] Position encoding: Position embedding is generated using sine and cosine functions.

[0052]

[0053] Where pos is the position index and i is the dimension index;

[0054] (2) Bidirectional GRU and contextual feature extraction

[0055] Using a two-layer bidirectional GRU layer, a unidirectional GRU cell passes through the reset gate r t With Update Gate z t Controlling the flow of information, h t For the hidden state, σ is the sigmoid function and tanh is the hyperbolic tangent function, calculated as follows:

[0056]

[0057] positive Reverse Hidden state splicing Achieve contextual information fusion;

[0058] (3) Enhanced self-attention and long-range dependency modeling

[0059] Local context-aware attention: Attention weights are generated through a two-layer perceptron, using the following formula:

[0060]

[0061] exp is the exponential function, w1 is the weight matrix, and b1 is the bias vector;

[0062] Multi-head self-attention (MHA): This method splits the feature into multiple heads, with each head independently calculating attention.

[0063]

[0064] Q i ,K i V i Let i be the query, key, and value vector of the i-th head. The results of multiple heads are concatenated and then output after linear transformation.

[0065] Furthermore, step S3, the feature fusion step, includes:

[0066] (1) Image modalities are used to extract spatial features through a convolutional neural network to obtain a feature vector with dimension D1 = 256. Capture the spatial distribution patterns of encrypted data;

[0067] (2) For sequence modalities, the Transformer model is used to extract temporal features. The temporal statistics generated by the sliding window are embedded and encoded by the position layer, and then captured by the temporal network to generate a D2=128 feature vector. Characterizes the temporal dynamics of CAN messages;

[0068] (3) In the core fusion stage, a stitching fusion strategy is adopted: image features are combined. Similar to this, all of them need to be modified and sequence features Through formula Concatenate into a vector of one dimension Where D3 = 384, after the splicing is completed, the spliced ​​features need to be reduced in dimensionality. The formula for dimensionality reduction is:

[0069] f fusion =Dropout(ReLU(BN(W1f)) concat +b1)))

[0070] Furthermore, in step S4, when the data is passed to the output layer, the previous layer outputs f1 to f5 are transformed into probability distributions p1 to p5 by the Softmax function to achieve the multi-classification task. The formula for the Softmax function is:

[0071]

[0072] z i is the i-th element of the input vector, representing the raw score of the i-th category; n is the total number of categories; e is the natural constant; σ(z) i The probability value of the i-th category is obtained after Softmax processing. Then, based on the negative log-likelihood loss function, the weights are iteratively optimized using the backpropagation algorithm. The formula is:

[0073] NLL(q,y)=-log(q y )

[0074] Logarithmic probability logq (obtained by taking the logarithm of softmax) and true class index y.

[0075] Another objective of this invention is to provide an in-vehicle network encrypted malicious traffic identification system based on an attention mechanism, the system specifically comprising:

[0076] The data preprocessing module is used to perform a series of data preprocessing operations on the Car-Hacking dataset to make it more suitable for model learning and analysis;

[0077] The spatial feature extraction module is used for efficient spatial feature extraction using an optimized CNN structure.

[0078] The temporal feature extraction module is used to capture temporal features by combining a GRU network, a self-attention mechanism, and a Transformer encoder.

[0079] The feature fusion module is used to integrate complementary information from image modalities and sequence modalities, and achieves comprehensive representation of CAN bus data through multi-stage processing;

[0080] The model training and classification module is used to train models and determine whether there is any intrusion behavior in the current traffic data.

[0081] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:

[0082] First, this invention proposes an attention-based in-vehicle network (IVN) encrypted malicious traffic identification system for the CAN bus of an IVN without relying on hardware. The system employs the lightweight XTEA algorithm to encrypt the raw CAN bus data, simulating a real IVN encrypted environment. The encrypted data is simultaneously converted into two-dimensional image features and temporal sequence features. An optimized CNN structure is used for efficient spatial feature extraction, while a combination of a GRU network, self-attention mechanism, and Transformer encoder is used to capture temporal features. Finally, feature fusion is used for training, achieving accurate identification of different types of attacks. The system was comprehensively and systematically evaluated on the Car-Hacking dataset. Experimental results show that the proposed hybrid architecture achieves excellent detection performance in encrypted environments. In binary classification tasks, the precision, recall, and F1 score for distinguishing normal traffic from attack traffic are all 100%, achieving efficient malicious traffic identification. In multi-class classification tasks, despite increased data complexity, our hybrid model still achieved a precision of 95.05%, an F1 score of 94.48%, and a recall of 94.82%, with an average recall of 99.775% across all attack types. Compared to a single LSTM model, these key metrics were improved by 3.86%, 2.47%, and 1.07%, respectively; compared to a DCNN model, improvements were made by 7.79%, 6.3%, and 4.9%, respectively; and compared to the Transformer framework, improvements were made by 3.33%, 5.3%, and 1.96%, respectively. Furthermore, the system's average processing time during the inference phase was only 0.2384 ms / sample, fully meeting the real-time requirements of in-vehicle environments.

[0083] Secondly, as supplementary evidence of the inventive step of the claims of this invention, it is also reflected in the following important aspects:

[0084] (1) The expected benefits and commercial value of the technical solution of this invention after transformation are as follows:

[0085] 1) Enhance vehicle network security: By identifying encrypted malicious behavior in the vehicle without decrypting traffic, this invention can significantly improve the security protection capabilities of the vehicle network system and meet the dual requirements of data privacy and security for future intelligent connected vehicles.

[0086] 2) Reduce operating and maintenance costs: Early warning of potential attacks can reduce the high recall or repair costs caused by security incidents, improving the economic benefits for OEMs and suppliers.

[0087] 3) Enhance user trust and brand competitiveness: As consumers pay more attention to data security, this technology can become an important selling point for automakers' security capabilities, enhancing brand trust and market competitiveness.

[0088] 4) Scalable deployment adaptable to multiple platforms: Due to its reliance on feature-level detection and attention mechanism models, it can be adapted to different vehicle buses (such as CAN, Ethernet) and vehicle platforms, making it suitable for mass deployment and bringing considerable commercial promotion potential.

[0089] 5) Opportunities for derivative value-added services: Data aggregation and remote security upgrades can be combined with cloud services to encourage manufacturers to develop vehicle networking security operation services and generate continuous revenue.

[0090] (2) The technical solution of this invention fills a technical gap in the industry both domestically and internationally:

[0091] 1) Existing encrypted traffic detection methods are mostly based on decryption or traditional statistical features, which makes it difficult to balance privacy and detection accuracy; while encrypted malicious traffic identification based on attention mechanisms has not yet been widely applied in the field of in-vehicle networks.

[0092] 2) Although the latest research involves the fusion of spatial-temporal attention models, its applications are more concentrated in traditional network scenarios and have not focused on the field of vehicle-mounted encrypted communication.

[0093] 3) Meanwhile, spatial feature-based and temporal feature-based methods have only been proposed as research directions in in-vehicle network anomaly detection, and have not been used for encrypted malicious flow identification.

[0094] 4) This invention is the first to apply the attention mechanism to the identification of malicious behavior in encrypted in-vehicle traffic, filling the technological gap in the industry for efficient anomaly detection under privacy protection constraints.

[0095] (3) The technical solution of the present invention solves a technical problem that people have long wanted to solve but have never been able to solve successfully:

[0096] 1) The contradiction between encrypted privacy and security: Traditional intrusion detection relies on payload content, which is almost ineffective when faced with encrypted traffic; however, this invention can identify abnormal behavior without decryption, breaking this dilemma.

[0097] 2) Conflict between real-time performance and resource constraints: In-vehicle systems are sensitive to latency and resource consumption. Attention mechanisms can improve detection efficiency and reduce resource consumption while highlighting key temporal features, thus achieving real-time recognition.

[0098] 3) Challenges in identifying complex temporal dependencies: Vehicle communication features are complex and ever-changing. Attention layers can dynamically focus on key data segments to improve the ability to identify specific attack patterns.

[0099] 4) Cross-vehicle adaptation challenge: Traditional solutions often couple to specific vehicle models or protocols. This invention is based on general features and model structure, and has a wider range of cross-platform adaptation capabilities, solving the reusability problem that has long plagued the industry.

[0100] (4) The technical solution of the present invention overcomes technical bias:

[0101] 1) Breaking away from the traditional mindset that "decryption is required before detection": This invention proves that efficient identification can still be achieved through surface features and attention mechanisms while preserving content privacy, overturning conventional biases.

[0102] 2) Challenging the prejudice that "high-performance network detection can only be achieved through complex decoding and resource-intensive models": This invention utilizes a lightweight attention module to focus on identifying key features, achieving accurate detection with lower computational cost.

[0103] 3) Breaking the limited view that "in-vehicle network security can only be achieved through physical isolation or hardware hardening": By strengthening intrusion identification at the intelligent algorithm level, it is demonstrated that software-level security measures can also play a core role in in-vehicle networks.

[0104] 4) Eliminate the old notion that "model generalization is difficult to cross vehicle models and protocols": Propose a general structure that can be adapted to multiple vehicle models and protocols, demonstrating that this method has greater potential for industrial application. Attached Figure Description

[0105] Figure 1 This is a flowchart of the in-vehicle network encrypted malicious traffic identification method based on attention mechanism provided in the embodiments of the present invention;

[0106] Figure 2 This is a flowchart of the model training and classification process provided in an embodiment of the present invention;

[0107] Figure 3 This is a schematic diagram of a vehicle in-vehicle network encrypted malicious traffic identification system model based on an attention mechanism provided in an embodiment of the present invention;

[0108] Figure 4 This is a model architecture diagram of an in-vehicle network encrypted malicious traffic identification system based on an attention mechanism provided in an embodiment of the present invention;

[0109] Figure 5 This is a time diagram of the encryption methods provided in the embodiments of the present invention;

[0110] Figure 6 This is a confusion matrix diagram for detecting Gear attacks, DOS attacks, RPM attacks, and Fuzzy attacks provided in this embodiment of the invention;

[0111] Figure 7 This is a graph showing the average performance of the hybrid model provided in this embodiment of the invention on the overall test set. Detailed Implementation

[0112] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0113] like Figure 1 As shown, this embodiment of the invention provides a method for identifying encrypted malicious traffic in a vehicle intranet based on an attention mechanism. The method specifically includes:

[0114] S1: Data preprocessing. Before using the Car-Hacking dataset for training the malicious traffic identification module, a series of data preprocessing operations are performed. The XTEA lightweight algorithm is used to encrypt the original CAN bus data, and the encrypted data is converted into two-dimensional image features and time sequence features at the same time.

[0115] S2: Feature extraction. Design a CNN-Transformer hybrid model to achieve spatial feature extraction and temporal feature extraction of the data through dual-branch parallel processing.

[0116] S3: Feature fusion, which integrates complementary information from image modalities and sequence modalities, and achieves comprehensive representation of CAN bus data through multi-stage processing;

[0117] S4: Model training and classification, feeding the fused features into a multilayer perceptron for model training, and determining whether there is intrusion behavior in the current traffic data.

[0118] In the data preprocessing stage, raw CAN bus messages are first extracted from the Car-Hacking public dataset. The message format includes identifiers, data fields, and control bits. To simulate secure communication scenarios in a real-world in-vehicle environment, the lightweight symmetric encryption algorithm XTEA is used to encrypt the raw message data. Encryption not only ensures the confidentiality of in-vehicle communication data but also enables the model training phase to learn the traffic characteristics under encrypted scenarios. After encryption, the message data is transformed into two modalities: first, the byte stream is mapped to a two-dimensional matrix and converted into grayscale image features; second, the time-series format is maintained to preserve the sequential relationship of the data in the time domain.

[0119] During image feature construction, each CAN message frame is mapped to a pixel grayscale range through byte value normalization, forming a fixed-size two-dimensional image. This processing method can explicitly capture the spatial distribution pattern differences between messages, making maliciously injected or tampered messages exhibit abnormal features in pixel distribution. In this way, the original high-dimensional byte stream is transformed into image-like features, providing input for subsequent convolutional neural network branches.

[0120] During the construction of temporal features, the system retains the message sending timestamps and data fields, forming continuous sequence data. The sequence features not only include changes in the values ​​of each field but also reflect the correlation of traffic over time. To eliminate noise and enhance temporal stability, the original sequence is normalized and segmented using a sliding window, allowing the data to be input into the model as fixed-length time-slot sequences. This provides high-quality input for the subsequent Transformer-based attention mechanism branch.

[0121] In the feature extraction stage, a dual-branch structure of CNN and Transformer is designed. The CNN branch receives two-dimensional image features and uses convolutional kernels to extract local spatial patterns and potential regional anomalies; the Transformer branch receives sequence features and models the global dependencies between time steps through a self-attention mechanism, enabling the capture of hidden attack features across time slots. The dual branches achieve simultaneous extraction of spatial and temporal features during parallel operation, ensuring that the key attributes of malicious traffic under different modalities are effectively captured.

[0122] In the feature fusion and classification stage, feature vectors from the CNN and Transformer branches are concatenated and fed into a multi-stage fusion module. This module uses an attention weighting mechanism to achieve complementary enhancement of features from different modalities, thereby obtaining a comprehensive representation of CAN bus traffic. Finally, the fused features are input into a multilayer perceptron classifier, and the trained model outputs a binary classification result to determine whether the current message traffic contains malicious intrusion behavior. The entire process ensures that the multimodal features of the encrypted in-vehicle traffic are fully utilized, thereby improving the accuracy and robustness of malicious traffic identification.

[0123] Before using the Car-Hacking dataset for training the malicious traffic identification module, step S1 requires a series of data preprocessing operations to improve data quality and make it more suitable for model learning and analysis. This mainly consists of three steps: data cleaning, data encryption, and feature transformation, detailed below:

[0124] (1) Data cleaning

[0125] During the collection and storage of datasets, issues such as missing data, inconsistent formats, disordered timestamps, and interference from invalid headers may arise. For example, sensor malfunctions may cause some data fields to contain NaN values, timestamps collected by different devices may be stored as strings or non-numeric formats, and the raw data may contain header lines or unstructured text. If these issues are not addressed, they will directly lead to biased data analysis results, failure in machine learning model training, and errors in temporal feature extraction. In particular, in anomaly detection scenarios, they may misjudge normal data or miss attack behaviors.

[0126] To address the aforementioned issues, the data cleaning process achieves data standardization through multiple methods: First, invalid rows containing missing values ​​are removed to ensure data integrity; second, potential header rows are removed by inspecting the first row content to avoid semantic interference; third, timestamps are uniformly converted to numeric types and sorted by time to construct accurate temporal logic; finally, key columns are extracted and hexadecimal data is converted to integers through type conversion to eliminate format differences. This interconnected process, from data quality screening to format standardization, gradually resolves the structural problems of the original data.

[0127] The core significance of data cleaning lies in building a reliable data foundation for subsequent processing. It not only improves data purity by filtering out invalid information, but also ensures that CAN bus data accurately reflects the real communication status of the vehicle network through timing alignment and format standardization.

[0128] (2) Data encryption

[0129] The preprocessed data is encrypted using the XTEA method. The preprocessed 64-bit plaintext data is evenly divided into a 32-bit left half (v0) and a right half (v1), constructing initial data pairs (v0, v1). This data splitting method is the standard input format for the Feistel network, laying the foundation for subsequent iterative encryption. Then, the 128-bit key is parsed into four 32-bit subkeys k0, k1, k2, k3, and a fixed constant δ = 0x9e3779b9 is introduced as an iteration parameter. This parameter disrupts the data pattern during encryption, enhancing its randomness and complexity.

[0130] Based on the iterative rules of the Feistel network, data obfuscation is achieved through 32 rounds of encryption operations. In the i-th iteration, let sum = i × δ (using modulo-2^32 arithmetic). This operation not only makes the parameters of each iteration exhibit a certain dynamic change, but also achieves a certain degree of security for the encryption. According to the formula...

[0131]

[0132] Update the left half of the formula.

[0133]

[0134] Part of the data is shuffled by circularly shifting left by 4 bits, circularly shifting right by 5 bits, adding to the original data, and then performing an XOR operation; then it is combined with (sum+k) to achieve a complete data shuffling. sum&3 Perform an XOR operation to incorporate the subkey into the data. Then, according to the formula...

[0135]

[0136] Update the right half.

[0137] By employing cyclic shifting, XOR, and modulo addition operations to achieve thorough mixing of data and key, operation is possible even in resource-constrained environments. After 32 rounds of iteration, the final (v0, v1) sub-blocks are merged into 64-bit ciphertext. This bitwise-based iterative mechanism, leveraging the reversibility of the Feistel network and its dynamic key selection strategy, ensures computational efficiency while increasing the difficulty for attackers to crack the encryption, thus guaranteeing the security of the encrypted data.

[0138] (3) Feature transformation

[0139] To convert the encrypted data into a feature format suitable for model input, feature transformation is also required. This invention employs two feature extraction methods: First, the encrypted data is converted into a 21×21×3 RGB image. Firstly, a certain amount of data required to construct the image is extracted. Then, the data is reshaped into a 9×9×3 image format and enlarged to a size of 21×21×3 using bilinear interpolation. Finally, all image data is standardized to have a mean of 0 and a standard deviation of 1, resulting in preprocessed data suitable for neural network model input. Second, based on a sliding window statistical method, temporal features of the encrypted data are constructed for training the Transformer network. By setting the sliding window size and stride, sliding statistics are performed on the encrypted data to extract statistical features such as the mean, variance, and frequency of the data within the window as temporal features.

[0140] S2, for the spatial and temporal correlation of data in the CAN bus, designed a CNN-Transformer hybrid model. This model realizes the extraction of spatial features and temporal features of data through dual-branch parallel processing.

[0141] (1) Spatial feature extraction

[0142] Leveraging the powerful local feature extraction capabilities of convolutional neural networks (CNNs), local spatial patterns of data are modeled, effectively addressing the shortcomings of traditional methods in capturing spatial features. The CNN image feature branch is responsible for feature extraction from encrypted CAN bus data converted into 21×21×3 RGB images. This branch employs a three-dimensional convolutional kernel design and utilizes batch normalization, ReLU functions, and pooling layers to handle local spatial transformations, significantly enhancing its robustness under complex CAN bus data.

[0143] 1) Convolution operation

[0144] In image feature extraction, convolutional kernels extract local features by sliding across the image and performing weighted summation on pixels in local regions. The 3D convolutional kernel is 3×3 in size, which allows it to focus on smaller local areas and capture subtle structural and pattern information. When processing images from encrypted CAN bus data conversions, 3×3 convolutional kernels can effectively detect specific pixel combination patterns, which is beneficial for subsequent malicious traffic detection. By stacking multiple 3×3 convolutional layers, the network depth can be increased while maintaining the ability to extract fine local features, reducing the number of parameters and computational complexity, thereby improving the model's training efficiency and generalization ability.

[0145] 2) Batch normalization

[0146] A batch normalization (BN) layer is embedded after each convolutional layer to alleviate the internal covariate offset problem through the following normalization operation:

[0147]

[0148] in, and These are the mean and variance of the batch statistics, γ. (k) and β (k) These are learnable scaling and offset parameters. Batch normalization makes the network training process more stable, accelerates convergence, and enhances the network's generalization ability.

[0149] 3) ReLU activation function

[0150] In the neuron activation process of a neural network, the ReLU (Revised Linear Unit) introduces activation characteristics through the following nonlinear mapping:

[0151] f(x) = max(0,x)

[0152] Here, x represents the net input value of the neuron (i.e., the sum of the weighted sum of the outputs of the previous layer and the bias term), and f(x) is the output after activation. This function has no parameters that need to be learned, and its output characteristics are directly determined by the input value: when x≥0, the output equals the input (linear activation region); when x<0, the output is always 0 (inhibition region).

[0153] 4) Pooling layer

[0154] After features are extracted by convolutional layers, the resulting feature maps usually have high dimensionality. This not only increases the burden of subsequent computation but may also lead to overfitting. Therefore, pooling layers are needed to reduce the dimensionality of the feature maps while preserving key features.

[0155] The pooling window size and stride are automatically adjusted based on the size of the input feature map to downsample the feature map, thereby reducing its dimensionality. This reduces computational cost while preserving key information in the feature map, allowing the model to focus more on features important for classification. Furthermore, pooling layers enhance the model's adaptability to changes in input image size, improving its robustness.

[0156] The convolutional block architecture is as follows:

[0157] 1) First stage

[0158] A 3×3 convolutional kernel group (C=64 channels) is used to perform feature extraction based on a local sliding window mechanism. The core of this operation is to capture low-level features such as basic edges and textures in the image by operating the convolutional kernel with local regions of the image, thus providing a foundation for subsequent feature abstraction.

[0159] After the convolution operation, a 2×2 max pooling operation is performed using the downsampling formula:

[0160]

[0161] l represents the number of layers in the neural network, i represents the row index, j represents the column index, and m and n are used to index the position within the pooling window of the input features. The feature map size is compressed from 21×21 to 10×10. This operation not only effectively reduces the redundancy of low-level features and the subsequent computational load, but also allows the model to focus on more salient features in the image, enhancing the expressive power of the features.

[0162] 2) Second stage

[0163] A 128-channel convolutional layer is deployed to capture intermediate semantic features (such as signal cluster structure information). As the network depth increases, this stage utilizes more channels to integrate and abstract the basic features extracted in the first stage, uncovering features with certain structure and semantics from the signal matrix. Pooling operations are then used to further compress the feature map size to 5×5, improving the level of feature abstraction and enabling the model to learn more representative image information.

[0164] 3) Third stage

[0165] A 256-channel convolutional layer is used for high-level semantic feature learning. This high-channel-count convolutional layer aims to perform deep processing on the intermediate features extracted in the first two stages, learning more complex and semantically rich feature patterns in the image, thereby identifying key information such as anomalous signals. Finally, average pooling is used to output a global feature vector with a dimension of 256.

[0166]

[0167] i and j represent the values ​​of the output feature map at their respective positions, X is the input feature map, k is the size of the pooling window, m and n are used to index the position within the 2×2 pooling window of the input feature map, and s is the stride, controlling the window sliding distance. This operation converts the feature map into a fixed-dimensional vector, facilitating subsequent classification, regression, and other tasks.

[0168] (2) Temporal feature extraction

[0169] In the timing branch of the Transformer, encoding is required. Position encoding is a key element that enables the model to process sequential information. This encoding method generates a unique vector for each position, effectively capturing the relationship between different positions in the sequence through the periodicity and continuity of sine and cosine functions. When processing the timing characteristics of CAN bus data, position encoding enables the model to distinguish data points at different times, thereby understanding the order and time dependencies of the data.

[0170] To further enhance the model's ability to process long-sequence data, a GRU mechanism was introduced. GRU (Gated Recurrent Unit), as a recurrent neural network structure, excels at handling short-term dependencies in time-series data. When working with the Transformer, the GRU first performs preliminary processing on the input time-series features, controlling the flow of information through gating mechanisms (update and reset gates) to retain important short-term information. Then, the GRU-processed features are input into the Transformer, which utilizes its powerful attention mechanism to perform global modeling of the entire sequence, capturing long-distance dependencies. For example, when analyzing CAN bus data over a relatively long period, the GRU can promptly capture the changing trends between adjacent data points, while the Transformer can analyze the correlation between data from different time periods from a global perspective, determining whether intrusion behavior exists. Through the collaborative work of GRU and Transformer, the model can fully integrate short-term and long-term information, improving its ability to recognize complex time-series patterns.

[0171] 1) Sequence embedding and positional encoding

[0172] Application scenario: Processing CAN bus timing sequences of length L=10 (such as the ID and data fields of consecutive communication frames), requiring preservation of sequence information to detect timing anomalies such as replay attacks. The technical process is as follows:

[0173] Feature embedding: Mapping the original features (dimension D) to the Transformer feature space (dimension d) through a linear layer. model =128), the specific formula is:

[0174] h t =W e xt +b e

[0175] This step transforms raw features into abstract semantics, providing a foundation for subsequent positional encoding and sequence modeling.

[0176] Position encoding: To address the permutation invariance problem inherent in pure Transformers, position embeddings are generated using sine and cosine functions.

[0177]

[0178] Here, pos is the position index and i is the dimension index. This encoding mechanism endows the model with absolute position awareness through the periodicity of trigonometric functions, enabling it to capture the relative positional relationships of sequences of arbitrary length, theoretically supporting the processing of infinitely long sequences. Simultaneously, position encoding requires no training, belonging to a zero-parameter embedding design, effectively reducing the number of model parameters and significantly improving the adaptability and computational efficiency of industrial edge devices. The position encoding and feature embedding are added together and then input into the Transformer encoder. This superposition method preserves the semantic information of the original features while incorporating positional information, allowing the model to consider both content and order when processing sequence data, laying the foundation for subsequent bidirectional GRU and contextual feature extraction.

[0179] 2) Bidirectional GRU and contextual feature extraction

[0180] When processing continuous sampled values ​​from vehicle sensors, such as accelerator pedal signal sequences, it is necessary to capture the causal relationship between preceding and following time steps. Therefore, a two-layer bidirectional GRU layer is used, with a unidirectional GRU unit controlling the reset gate r. t With Update Gate z t Controlling the flow of information, h t For the hidden state, σ is the sigmoid function and tanh is the hyperbolic tangent function. The calculation formula is as follows:

[0181]

[0182] positive Reverse Hidden state splicing Achieve contextual information fusion. By modeling the context and utilizing both forward and backward information, improve the ability to detect abnormal traffic;

[0183] 3) Enhanced self-attention and long-range dependency modeling

[0184] Local context-aware attention: To accurately capture key time step information, attention weights are generated through a linear layer and an activation function, as shown in the formula:

[0185]

[0186] exp is the exponential function, w1 is the weight matrix, and b1 is the bias vector. This formula applies to the GRU output h. t The significance of weighted summation lies in dynamically selecting the time steps that play a decisive role in anomaly detection from complex time-series data, effectively highlighting anomaly features and enhancing the model's ability to perceive key local information.

[0187] Multi-head self-attention (MHA): This method splits the feature into multiple heads, with each head independently calculating attention.

[0188]

[0189] Q i ,K i V i Let be the query, key, and value vector of the i-th head. The core significance of this design lies in parallel processing of features from multiple different representation subspaces, simulating the multi-dimensional thinking pattern of the human brain. This allows the model to capture dependencies between data from different angles, particularly excelling at modeling long-range dependencies, thereby comprehensively mining complex correlation information across time steps in device operation logs. The multi-head results are concatenated and then linearly transformed for output, achieving feature fusion and enhancement.

[0190] The feature fusion step S3 includes:

[0191] (1) Image modalities are used to extract spatial features through a convolutional neural network to obtain a feature vector with dimension D1 = 256. Capture spatial distribution patterns of encrypted data, such as anomalous clustering of byte blocks;

[0192] (2) For sequence modalities, the Transformer model is used to extract temporal features: the temporal statistics generated by the sliding window are embedded and encoded by the position layer, and then the temporal network is used to capture long-short-term dependencies to generate a D2=128 feature vector. Characterizes the temporal dynamics of CAN messages;

[0193] (3) In the core fusion stage, a stitching fusion strategy is adopted: image features are combined. and sequence features Through formula Concatenate into a vector of one dimension Where D3 = 384. After the splicing is completed, the spliced ​​features need to be dimensionality reduced. The formula for dimensionality reduction is:

[0194] f fusion =Dropout(ReLU(BN(W1f)) concat +b1)))

[0195] Multiple methods are employed to mitigate overfitting and enhance cross-modal interaction. These methods effectively reduce feature redundancy and highlight key information; Batch Normalization (BN) accelerates model convergence and improves training stability by standardizing inputs; the ReLU activation function is used to stabilize the dimensionality reduction process; and Dropout introduces randomness into the model by randomly discarding neurons, thus avoiding overfitting. These three methods work synergistically to promote full interaction of features from different modalities during nonlinear transformations, uncovering potential spatiotemporal joint patterns.

[0196] S4, the multilayer perceptron training process and classification prediction diagram is as follows: Figure 2 As shown in the diagram, this training flowchart illustrates a neural network architecture used for training. The input layer contains x1 to x2. 192 The input nodes carry the features of the input data. They are followed by three hidden layers, each containing a different number of neurons (such as h1, h2, etc.). The layers are connected by weights w1, w2, etc., and are responsible for performing step-by-step feature extraction and nonlinear transformation on the input data.

[0197] When the data is passed to the output layer, the Softmax function transforms the previous layer's outputs f1 to f5 into probability distributions p1 to p5 to achieve the multi-class classification task. The formula for the Softmax function is:

[0198]

[0199] z i is the i-th element of the input vector, representing the raw score of the i-th category; n is the total number of categories; e is the natural constant; σ(z) i ) is the probability value of the i-th category after Softmax processing.

[0200] Obtaining the probability values ​​signifies the classification result. Then, based on the negative log-likelihood loss function, the weights are iteratively optimized using the backpropagation algorithm to minimize the difference between the predicted and true labels, thereby improving model performance. The formula is:

[0201] NLL(q,y)=-log(q y )

[0202] The logarithmic probability logq (obtained by taking the logarithm of the softmax function) and the true class index y. The advantages of Negative Log-Likelihood Loss (NLLLoss) are mainly reflected in two aspects: First, it has a clear probabilistic interpretation, directly corresponding to maximum likelihood estimation, conforming to the theoretical basis of statistics, and can optimize the log-likelihood predicted by the model; second, it is suitable for tasks requiring precise probabilistic modeling, can naturally combine with probabilistic models, and outputs results with clear probabilistic meaning. Compared with cross-entropy loss, NLLLoss places greater emphasis on optimizing the probability distribution and has higher computational efficiency, making it more suitable for the real-time requirements of connected vehicle scenarios.

[0203] like Figure 3 , Figure 4 As shown in the figure, an in-vehicle network encrypted malicious traffic identification system based on an attention mechanism provided by an embodiment of the present invention specifically includes:

[0204] The data preprocessing module is used to perform a series of data preprocessing operations on the Car-Hacking dataset to make it more suitable for model learning and analysis;

[0205] The spatial feature extraction module is used for efficient spatial feature extraction using an optimized CNN structure.

[0206] The temporal feature extraction module is used to capture temporal features by combining a GRU network, a self-attention mechanism, and a Transformer encoder.

[0207] The feature fusion module is used to integrate complementary information from image modalities and sequence modalities, and achieves comprehensive representation of CAN bus data through multi-stage processing;

[0208] The model training and classification module is used to train models and determine whether there is any intrusion behavior in the current traffic data.

[0209] In summary, this invention achieves layer-by-layer abstraction and nonlinear transformation of input features through a multi-layer perceptual structure, ultimately utilizing the Softmax function to output multi-classification results, and combining this with a negative log-likelihood loss function for optimization. The overall training process, driven by the backpropagation mechanism, continuously iterates and updates the weight parameters, simultaneously guiding the CNN and Transformer modules in feature extraction. This enables the model to self-adjust its feature extraction capabilities, better extracting more important and meaningful features from CAN data frames, thereby improving the overall performance of the model and helping it understand the complex data of CAN data frames. In this process, classification accuracy is gradually improved. This invention not only possesses excellent probabilistic interpretation capabilities but also exhibits high efficiency and practicality, making it particularly suitable for intelligent system scenarios such as vehicle networking where real-time performance and accuracy are critical.

[0210] I. Specific application areas or related products of this invention.

[0211] Garrett Intrusion Detection System (IDS) for Vehicles:

[0212] Garrett's Intrusion Detection System (IDS) is a highly mature software solution that is hardware independent. It intelligently reads and analyzes all traffic in the vehicle network, including various in-vehicle buses such as CAN, CAN FD, and Ethernet, identifying and marking abnormal or malicious messages in real time. It integrates over 50 advanced monitoring algorithms, covering most network attack scenarios that connected vehicles may face, and enables flexible integration across buses and platforms. Its technical architecture is known for its deployment method, which is independent of system hardware and operating systems, offering easy integration and high adaptability, allowing for rapid deployment to critical nodes such as ECUs, gateways, and host control units. From a functional and performance perspective, Garrett IDS continuously scans in-vehicle network traffic, promptly detecting abnormal signals caused by physical connections or remote triggers, intercepting potential malicious behavior, and proactively reporting abnormal events to the cloud-based Security Operations Center (SOC), forming a closed-loop defense mechanism of "detection-isolation-reporting-remediation." Its superior performance is reflected in high detection rates, low false alarm rates, and low in-vehicle CPU utilization, enabling stable operation even in resource-constrained in-vehicle environments. In terms of industrial applications, Garrett IDS has achieved large-scale mass production and deployment, adapting to numerous intelligent vehicle and commercial vehicle projects. It helps manufacturers meet increasingly stringent cybersecurity regulations for the connected vehicle lifecycle, such as UNECE R155, and supports regulatory security certifications. In addition to vehicle-side deployment, the system collaborates with cloud-based SOC and SIEM (Security Information and Event Management) platforms to perform root cause analysis of alerts, rule updates, and event management, ensuring the entire fleet's security posture monitoring capabilities and supporting the processing of tens of millions of alert data points monthly. Simultaneously, its ability to differentiate between faults and intrusion behaviors helps reduce false alarms and improve analysis efficiency.

[0213] II. Evidence related to the technical effects obtained by the embodiments of the present invention.

[0214] 1. Real-time assessment

[0215] In an encrypted malicious traffic identification system on an in-vehicle CAN bus, real-time performance is a crucial performance indicator, directly impacting the system's response speed to attacks and vehicle safety. This study first compares the encryption time of XTEA with other encryption methods. Then, it provides detailed statistics on the single-frame processing latency (including encryption and inference) of an XTEA-enhanced multimodal Transformer network for encrypted malicious traffic identification on an in-vehicle CAN bus. Furthermore, it analyzes the CPU and GPU memory usage during operation to comprehensively evaluate the system's real-time performance and resource consumption.

[0216] like Figure 5 As shown, the time curve (black square) of the XTEA encryption algorithm consistently lies below Present (red dot) and AES (blue triangle), demonstrating a significant speed advantage. For 500 messages, XTEA takes 0.0326 seconds, only 66.8% of AES (0.0488 seconds) and 11.1% of Present (0.2942 seconds); for 1000 messages, XTEA takes 0.0649 seconds, 33.2% faster than AES (0.0970 seconds) and 11.0% of Present (0.5879 seconds); for up to 2000 messages, XTEA takes 0.1497 seconds, 22.1% faster than AES (0.1922 seconds) and only 13.1% of Present (1.1415 seconds). The linear growth trend indicates that XTEA, thanks to its vectorized computation acceleration technology, maintains extremely low time overhead (minimum slope) even with increasing message volume, ensuring a single-frame encryption latency of only 1.2 milliseconds (Table 3.2 data, proportionally converted from batch message scenarios; actual single-frame efficiency is even better). In comparison, AES encryption is slower (e.g., taking over 30% longer than XTEA for 2000 messages), and Present, due to its high algorithm complexity (steep time growth), is completely unable to meet the real-time requirements of automotive systems under large-scale data. XTEA's efficient encryption lays the first layer of guarantee for system real-time performance, enabling millisecond-level processing during the encryption phase, leaving ample time for subsequent inference.

[0217] Table 1 shows the system's inference time for various types of attack data.

[0218]

[0219] As can be seen from the data in Table 1, on the CAR-HACKING dataset, the system demonstrates excellent inference latency performance for various attack data: the average inference times for DoS attacks, Fuzzy attacks, and Spoofing (Gear / RPM) attacks are 0.2276ms, 0.2422ms, 0.2379ms, and 0.2459ms, respectively, all of which are kept at an ultra-low level of less than 0.25ms.

[0220] 2. Accuracy Assessment

[0221] (1) Performance evaluation based on binary classification task

[0222] This experiment aims to verify the binary classification performance of the hybrid model in distinguishing between specific attack types (structured attacks such as DoS / Gear / RPM spoofing and unstructured obfuscation attacks) and normal traffic. Binary classification datasets for each attack type (e.g., DoS vs. normal) are constructed independently, with the data divided into an 80% training set and a 20% test set for training. The model architecture uses CNN and Transformer for feature fusion. The classification ability is evaluated using multiple dimensions, including precision, recall, F1-score, and confusion matrix, compared to independent CNN / Transformer and classic LSTM models. The focus is on examining the model's feature capture and generalization performance under complex attack patterns.

[0223] like Figure 6 As shown, based on the confusion matrix of binary attack, the CNN-Transformer hybrid model proposed in this module demonstrates superior performance in the vehicle-mounted malicious traffic identification task, achieving a breakthrough with zero false positives in structured attack scenarios (DoS / Gear / RPM spoofing). This excellent performance stems from the dual advantages of the model architecture: First, the convolutional neural network, with its local feature extraction capability, can accurately capture fixed attack features, such as quickly identifying abnormal data patterns with specific CAN IDs (e.g., CAN ID=0) in denial-of-service (DoS) attacks; second, the Transformer module, through a multi-head attention mechanism, effectively establishes long-distance dependencies between data, performs consistency checks on time-series data, and thus identifies abnormal patterns in attack behavior that change over time. The synergistic effect of these two aspects not only significantly improves the model's detection accuracy for known attacks but also enhances its generalization ability in complex dynamic scenarios.

[0224] Meanwhile, we implemented several measures to mitigate the risk of overfitting. These measures included using five-fold cross-validation to ensure robustness, validating the model with independent test sets, and introducing regularization techniques such as dropout. Therefore, the 100% accuracy observed on the Car-Hacking dataset does not indicate overfitting.

[0225] (2) Performance evaluation based on five-class classification task

[0226] Deep learning-based CAN bus traffic analysis has significant research value in the field of vehicle network security. This subsystem innovatively proposes a hybrid model (CNN-Transformer) to address the complex and polymorphic network traffic in the CAR-HACKING dataset. By fusing the spatial feature extraction capabilities of convolutional neural networks with the global temporal modeling advantages of Transformers, it achieves a five-class attack detection task.

[0227] like Figure 7 As shown in the bar chart, this chart displays the average performance metrics of the classification model based on the CNN-Transformer hybrid model for extracting features from CAN bus data in the vehicle network on the overall test set. The data shows that the model's accuracy (94.74%), precision (95.05%), recall (94.82%), and F1 score (94.48%) are all at high levels, with minimal differences between the metrics, indicating that the model achieves a good performance balance in the classification task. The high synergy between precision and recall (both exceeding 94.5%) reflects the model's excellent performance in positive class identification (representation) and false positive control (precision), while the nearly 94.5% F1 score further validates its ability to harmonize these two aspects. High accuracy demonstrates the model's overall ability to discriminate between different categories of CAN bus data, effectively handling complex patterns in the data. Combining the feature extraction advantages of CNN and Transformer (the former captures local features, while the latter models global dependencies), this model not only fully exploits the spatial and temporal features of CAN data but also demonstrates good stability and generalization ability during training. These results provide solid technical support for CAN data classification in vehicle-to-everything (V2X) scenarios (such as anomaly detection and message type recognition). The next step will be to conduct horizontal comparisons.

[0228] Table 2 Performance Comparison of Different Models

[0229]

[0230] As shown in Table 2 above, a horizontal comparison of classification performance reveals that the hybrid model leads the baseline model by 2.92-7.59 percentage points with an accuracy of 94.74%. The simultaneous improvement in precision (95.05%) and recall (94.82%) demonstrates that the model effectively controls false positives and false negatives while maintaining high classification accuracy. Notably, its F1-score reaches 94.48%, representing improvements of 2.47%, 6.3%, and 1.96% compared to LSTM, DCNN, and Transformer single models, respectively. This balanced performance confirms the optimization effect of the hybrid model on feature representation capabilities. Compared to other models, traditional DCNN struggles to capture long-range temporal dependencies due to the local perceptual nature of convolutional kernels, while the pure Transformer model, despite possessing a global attention mechanism, lacks sensitivity to sudden local features. The LSTM model, limited by the sequence processing efficiency of its gating mechanism, experiences a 1.3% recall decay when dealing with high-frequency CAN bus messages. The hybrid model achieves breakthroughs through two core mechanisms: First, it introduces the XTEA encryption layer, which scrambles the original data structure using a symmetric encryption algorithm, improving the uniformity of byte distribution and significantly increasing feature entropy, thereby enhancing the model's robustness to noise; Second, the Transformer module achieves global dependency modeling through a self-attention mechanism, which can accurately capture long-distance dependencies between different feature dimensions, further improving the model's recognition accuracy in complex attack scenarios.

[0231] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0232] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for identifying encrypted malicious traffic in an in-vehicle network based on an attention mechanism, characterized in that, Includes the following steps: S1: Data preprocessing. Before using the Car-Hacking dataset for training the malicious traffic identification module, a series of data preprocessing operations are performed. The XTEA lightweight algorithm is used to encrypt the original CAN bus data, and the encrypted data is converted into two-dimensional image features and time sequence features at the same time. S2: Feature extraction. Design a CNN-Transformer hybrid model to achieve spatial feature extraction and temporal feature extraction of the data through dual-branch parallel processing. S3: Feature fusion, which integrates complementary information from image modalities and sequence modalities, and achieves comprehensive representation of CAN bus data through multi-stage processing; S4: Model training and classification, feeding the fused features into a multilayer perceptron for model training, and determining whether there is intrusion behavior in the current traffic data.

2. The method according to claim 1, characterized in that, In S1, the XTEA lightweight encryption algorithm is used to encrypt the CAN bus data. The 64-bit plaintext data is split into a 32-bit left half and a 32-bit right half. The obfuscation and key injection are completed in 32 rounds based on the Feistel network to obtain the 64-bit ciphertext.

3. The method according to claim 1, characterized in that, The feature transformation in S1 includes: (1) Reshape the encrypted data into a 9×9×3 image format and enlarge it to a size of 21×21×3 by bilinear interpolation to obtain the image feature input; (2) The sliding window statistical method is used to extract time series statistics such as mean, variance, and frequency to form time series feature input.

4. The method according to claim 1, characterized in that, The spatial feature extraction in S2 employs a three-stage convolutional neural network. The first stage uses 64-channel convolution and 2×2 pooling, the second stage uses 128-channel convolution and pooling, and the third stage uses 256-channel convolution and global average pooling to obtain a 256-dimensional feature vector.

5. The method according to claim 1, characterized in that, The temporal feature extraction in S2 includes: (1) Sequence embedding and position encoding: mapping temporal features to a 128-dimensional feature space and adding sine and cosine position encoding; (2) A bidirectional GRU network is used to splice forward and reverse hidden states to obtain contextual information; (3) Multi-head self-attention mechanism, which performs weighted modeling of sequence features to capture long-range dependencies.

6. The method according to claim 1, characterized in that, In S3, a splicing and fusion method is used to splice spatial features and temporal features into a 384-dimensional vector, and then perform dimensionality reduction through linear transformation to obtain the fused feature representation.

7. The method according to claim 1, characterized in that, The classification step in S4 calculates the probability distribution of each category using the Softmax function and performs backpropagation training using the negative log-likelihood loss function to achieve malicious traffic classification.

8. A vehicle in-vehicle network encrypted malicious traffic identification system based on an attention mechanism, characterized in that, include: The data preprocessing module is used to clean, encrypt, and transform the features of the raw data from the in-vehicle network. The spatial feature extraction module is used to extract spatial features from encrypted data using a convolutional neural network. The temporal feature extraction module is used to extract temporal features using a GRU network and a self-attention mechanism. The feature fusion module is used to stitch together and fuse image modal and sequence modal features and perform dimensionality reduction; The model training and classification module is used for multi-class recognition based on Softmax.

9. The system according to claim 8, characterized in that, The data preprocessing module includes a data cleaning unit, an XTEA encryption unit, and a feature conversion unit. The data cleaning unit is used to remove missing value rows and convert timestamps. The XTEA encryption unit is used to implement 32 rounds of encryption using the Feistel structure. The feature conversion unit is used to generate image and temporal features.

10. The system according to claim 8, characterized in that, The temporal feature extraction module includes a sequence embedding unit, a bidirectional GRU unit, and a multi-head self-attention unit. The sequence embedding unit is used to map statistical features into a high-dimensional representation and perform positional encoding. The bidirectional GRU unit is used to capture contextual relationships. The multi-head self-attention unit is used to model long-range dependencies.

Images