Internet of vehicles intrusion detection method based on hierarchical feature enhancement and dynamic sparse attention mechanism

Abstract

The invention discloses an Internet of Vehicles intrusion detection method based on hierarchical feature enhancement and a dynamic sparse attention mechanism, and the method comprises the steps: firstly obtaining an original CAN bus message data stream, and carrying out the multi-modal data preprocessing and hierarchical feature construction; secondly, for hierarchical features, performing message-level depth feature compression and space-time statistical feature enhancement by adopting a dual-channel feature compression mechanism to form an enhanced mixed feature vector, and then constructing a neural network model of a dynamic sparse attention mechanism based on content awareness to perform feature extraction; and inputting a sparse attention calculation result into a hierarchical classifier, and predicting and outputting a detection result. And training the network model, and deploying the trained network model in a vehicle-mounted embedded device to realize real-time message monitoring and intrusion detection. According to the method, the calculation complexity and parameter quantity of the model are greatly reduced, the real-time performance in a vehicle-mounted environment is remarkably improved, and the detection capability on complex hidden attacks is effectively improved.

Description

Technical Field

[0001] This invention belongs to the field of vehicle network communication security technology, and specifically relates to a vehicle network intrusion detection method based on hierarchical feature enhancement and dynamic sparse attention mechanism. Background Technology

[0002] With the rapid development of automotive intelligence and connectivity, in-vehicle networks have become a core component of modern automobiles. CAN, due to its high reliability and low cost, has become the mainstream protocol for communication between electronic control units (ECUs) within vehicles. However, the CAN protocol was not designed with security in mind, lacking security mechanisms such as message authentication and encryption. This allows attackers to inject malicious messages into the CAN bus through physical access or remote penetration, posing a serious threat to vehicle safety, such as unauthorized control of doors, engine, and brakes.

[0003] To address the security challenges faced by vehicular networks, Intrusion Detection Systems (IDS) are widely considered an effective and feasible solution. Based on different detection principles, existing vehicular IDS can be mainly categorized into rule-based methods, statistical methods, and machine learning-based methods. Early research relied heavily on predefined rules or thresholds, identifying attacks by monitoring anomalies in specific parameters (such as vehicle speed and engine speed) or sudden changes in packet frequency. While simple and efficient, these methods struggle to handle complex and ever-changing attack patterns, and rule maintenance is costly. Subsequently, detection methods based on statistical features such as information entropy were proposed, detecting anomalies by measuring the randomness and regularity of network traffic. However, these traditional methods heavily rely on expert knowledge in feature engineering and have limited detection accuracy.

[0004] In recent years, with the development of artificial intelligence technology, IDS based on machine learning, especially deep learning, has become the mainstream research area. For example, methods based on convolutional neural networks (CNNs) treat CAN ID sequences as images for processing, but they have inherent limitations in handling temporal dependencies. Methods based on recurrent neural networks (RNNs) and their variants (such as Long Short-Term Memory networks (LSTM) and gated recurrent units (GRUs) focus on the temporal dynamic modeling of message sequences, effectively capturing contextual dependencies, but they suffer from slow training speeds, difficulty in parallelization, and gradient vanishing problems, facing efficiency bottlenecks when processing high-speed CAN traffic. Recently, methods based on the Transformer architecture have emerged due to their powerful self-attention mechanism; however, the computational complexity of the standard Transformer increases quadratically with the sequence length, putting enormous pressure on the limited computing resources of the vehicle ECU. Furthermore, its original positional encoding mechanism is designed for uniform sequences in natural language processing and cannot effectively represent the key feature of non-uniform and variable time intervals between CAN messages, resulting in insufficient time sensitivity.

[0005] Despite significant progress in existing research, several serious challenges remain: First, most methods only support binary classification of normal and abnormal, making it difficult to accurately identify and distinguish increasingly diverse attack types (such as denial-of-service, ambiguity, spoofing, replay, signal tampering, etc.), limiting their application value in real-world scenarios. Second, the false positive rate (FPR) and false negative rate (FNR) of many solutions still need improvement. Furthermore, existing deep learning models are often highly complex and computationally expensive, making real-time deployment and efficient inference difficult in resource-constrained in-vehicle embedded environments. Therefore, there is an urgent need in this field for a lightweight intrusion detection scheme that can balance high-precision multi-class detection, low computational complexity, high time sensitivity, and effectively reduce the false negative rate to address the security threats currently facing the Internet of Vehicles. Summary of the Invention

[0006] To address the shortcomings of existing vehicle-to-everything (V2X) intrusion detection technologies, such as insufficient detection accuracy, high computational complexity, inadequate utilization of temporal features, and weak generalization ability against unknown attacks, this invention provides a V2X intrusion detection method based on hierarchical feature enhancement and a dynamic sparse attention mechanism. This method is used to detect various network attacks in the vehicle's Controller Area Network (CAN) in real time and accurately. The method innovatively integrates message-level deep feature compression and sequence-level dynamic spatiotemporal correlation analysis to construct a hierarchical feature enhancement system. It replaces standard self-attention with a self-designed dynamic sparse attention mechanism, significantly reducing computational complexity while maintaining global perception capabilities. Furthermore, it introduces a multi-granularity adaptive decision mechanism, significantly improving the system's zero-day detection capability against unknown attacks.

[0007] Specifically, this invention involves: First, preprocessing the original CAN bus message stream and constructing hierarchical features for each message sequence to form a multimodal sample set with both spatial structure and temporal characteristics. Then, an innovative dual-channel feature compression mechanism is used to process the spatial and temporal features of the messages separately. These fused and enhanced feature vectors are input into a neural network model with a dynamic sparse attention mechanism, outputting compressed high-level feature representations. Next, attack identification is performed using a multi-granularity adaptive classifier, and an adaptive threshold discrimination mechanism is introduced to automatically adjust the decision threshold based on real-time traffic characteristics. Finally, the trained lightweight model is deployed to the vehicle terminal to achieve real-time monitoring of CAN traffic and trigger corresponding security response mechanisms. This invention solves the problems of low accuracy, high latency, and high computational complexity in real-time detection of various network attacks in resource-constrained vehicle environments.

[0008] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0009] A vehicle-to-everything (V2X) intrusion detection method based on hierarchical feature enhancement and dynamic sparse attention mechanism includes the following steps:

[0010] S1. Multimodal Data Preprocessing and Hierarchical Feature Construction: Obtain the original CAN bus message data stream and extract the identifier (ID), data field (Payload), and timestamp of each message. A hierarchical parsing strategy is adopted: First, the CAN bus messages are validated and noise filtered to remove non-critical data such as diagnostic messages; then, multi-granular feature construction is performed, decomposing the CAN ID into n-byte semantic features, dividing the data payload into m-byte structural features, with the sum of n and m being the CAN ID byte length; the timestamps in the message data stream are normalized using a logarithmic transformation; finally, continuous messages in the message data stream are segmented into fixed-length time sequences, forming a multimodal sample set with both spatial structure and temporal characteristics.

[0011] S2. Message-Level Deep Feature Compression and Spatiotemporal Statistical Feature Enhancement: This stage employs an innovative dual-channel feature compression mechanism to process the spatial and temporal features of the message separately. A lightweight convolutional autoencoder (LCAE) is designed for the spatial feature compression channel, specifically handling the concatenation features of CANID and data payload. A multi-scale temporal statistical feature extraction method is proposed for the temporal feature enhancement channel, processing the concatenation results of semantic and structural features. A multi-scale temporal statistical model is constructed, extracting multi-scale temporal statistical features for a fixed-length temporal sequence for the temporal feature enhancement channel, calculating three dimensions of temporal features. The deep features extracted by LCAE are adaptively weighted and fused with the multi-scale temporal statistical features, dynamically adjusting the importance of each feature dimension through a gating attention mechanism to form a more information-density enhanced hybrid feature vector.

[0012] S3. Dynamic Sparse Attention Temporal Modeling: A neural network model based on a content-aware dynamic sparse attention mechanism is constructed, solving the quadratic complexity problem of traditional Transformer-based vehicle network intrusion detection methods. For enhanced hybrid feature vectors, a Differentiable Timestamp Encoding (DTE) is designed, mapping time interval information to position vectors through a learnable nonlinear transformation, accurately representing the non-uniform temporal relationships between packets. An improved Local Sensitive Hash (LSH) grouping algorithm is used to group position vectors based on content similarity, with fine-grained attention calculations performed within each group. Then, the sparse pattern is dynamically determined based on the sequence content after the input attention calculation, focusing on potentially abnormal regions. Finally, a "local-global" hierarchical attention strategy is adopted, first calculating fine-grained attention within a local window, and then performing sparse attention calculations at the global level. This design reduces computational complexity while maintaining global awareness.

[0013] S4. Multi-granularity adaptive classification: The result of the sparse attention calculation extracted in S3 is input into a hierarchical classifier. The first level performs coarse-grained attack type classification (such as DoS, Fuzzy, Masquerade, etc.), and the second level performs fine-grained attack subclass identification. A dynamic threshold algorithm is proposed to automatically adjust the decision threshold according to real-time traffic characteristics. For sample traffic below the threshold, it is automatically marked as "unknown attack" and an active learning mechanism is initiated to continuously improve the detection capability.

[0014] S5. Model Deployment and Real-time Detection: Train the network model from steps S2 to S4 above, and then deploy it in an in-vehicle embedded device to achieve real-time packet monitoring and intrusion detection.

[0015] Furthermore, in step S2, the sample set undergoes message-level deep feature compression and spatiotemporal statistical enhancement, with the specific steps as follows:

[0016] S2.1 Spatial Feature Compression Channel: Addressing the structural characteristics of CAN messages, this invention designs a proprietary lightweight convolutional autoencoder (LCAE). This encoder employs a layered processing strategy, first concatenating semantic and structural features, and then compressing the features through a three-layer convolutional structure. The encoder structure is as follows: the input layer receives a 12×1 message vector, which is expanded to 16×1 using zero-padding to maintain size; the depthwise separable convolutional layer uses a 3×1 convolutional kernel, first performing depthwise convolution (independent convolution for each channel group), then pointwise convolution (1×1 convolution to fuse channels); grouped convolution is used to divide the channels into four groups, each group is convolved independently before concatenation, further reducing computational cost; the activation function used is the Swish activation function, which is smoother than ReLU and beneficial for gradient flow. After two layers of convolutional compression, the feature dimension is reduced from 12 to 8, with a compression rate of 33%, but more than 95% of the original information is retained through nonlinear transformation. The decoder section adopts a symmetrical structure, but is only used during the training phase to ensure the reconstructability of the feature representation.

[0017] S2.2, Temporal Feature Enhancement Channel: To address the issue of insufficient utilization of temporal information by pure content features, this invention proposes a multi-scale temporal statistical feature extraction method. This method quantifies the temporal characteristics of the message flow from three dimensions to obtain multi-scale temporal statistical features. ① Frequency Domain Feature Extraction: A sliding window mechanism (window size W = 29, step size S = 1) is used to calculate the frequency of each CANID within the window. For a given time window T... t =[m t-W+1 ,m t-w+2 ,...,m t ], frequency eigenvector F t The calculation formula is:

[0018]

[0019] Where Ⅱ is the indicator function, and i is the value of CAN ID. This feature captures the ID distribution pattern within a short time, and is particularly effective in detecting frequency-abnormal attacks such as DoS. ② Entropy domain feature extraction: Calculate the time window T t The information entropy of internal message distribution quantifies the randomness of traffic. Entropy is calculated using the standard formula:

[0020]

[0021] Where X represents the random event of different CAN IDs occurring within a specific time window (i.e., a message sequence); n represents the total number of possible values ​​for the random variable X; p iThis represents the frequency of the i-th CAN ID. The H(X) value quantifies the randomness and uncertainty of message distribution. Normal traffic usually maintains a relatively stable entropy value, while random injection attacks such as fuzzy attacks can significantly increase the entropy value, while denial-of-service attacks may decrease it. ③ Time-domain feature extraction: Calculate the statistics of the time interval between adjacent messages, including mean, variance, skewness, etc. This feature is used to capture abnormal fluctuations in message transmission rate. Replay attacks and intermittent injection attacks can disrupt the normal time interval pattern, causing the statistical features to deviate significantly from the normal baseline.

[0022] S2.3 Feature Fusion and Enhancement: To address the weight allocation issue in multi-feature source fusion, this invention designs a dynamic fusion strategy based on a gating mechanism. The 8-dimensional deep features extracted by LCAE are concatenated with multi-scale temporal statistical features (4-dimensional frequency domain, 1-dimensional entropy domain, and 4-dimensional temporal domain, totaling 9 dimensions) to form a 17-dimensional hybrid feature, which is then adaptively weighted using a gating attention network. This design allows the network to dynamically adjust the contribution ratio of spatial and temporal features based on the input content. For example, for attacks causing frequency anomalies, the gating network automatically increases the weight of frequency domain features; for content tampering attacks, it emphasizes spatial features.

[0023] Furthermore, in step S3, the dynamic sparse attention temporal modeling is performed, and the specific steps are as follows:

[0024] S3.1 To address the non-uniform time intervals between CAN messages, this invention designs a differentiable timestamp encoding (DTE), completely overcoming the limitations of traditional position encoding that assumes uniform intervals. First, consecutive timestamps are extracted from a preprocessed fixed-length time sequence, and the time interval between adjacent messages is calculated. Second, the DTE module maps these original time intervals into high-dimensional position vectors using a learnable nonlinear transformation layer (such as a multilayer perceptron), injecting absolute and relative time information. Finally, the generated position vectors are added to an enhanced hybrid feature vector to form a time-aware input representation, providing accurate temporal context for subsequent attention mechanisms.

[0025] S3.2 To address the local clustering characteristics of attacks on connected vehicles (V2V) networks, a content-aware sparse mechanism based on anomaly probability is proposed. First, the time-aware input representation is grouped using Local Sensitive Hash (LSH), and the sequence is divided into multiple groups based on message feature similarity. Global attention is calculated within each group, while sparse connections are used between groups. Simultaneously, the anomaly probability of each message location is calculated in real time. When the probability exceeds a dynamic threshold, local attention calculation is initiated for that location and its associated region. This strategy, combining grouping and anomaly guidance, ensures that the model concentrates computational resources on high-risk areas, significantly improving computational efficiency while maintaining global awareness.

[0026] A two-tiered attention computation mechanism, "local-global," is employed: first, fine-grained local attention computation is performed within a sliding window to comprehensively capture short-term attack patterns; then, global sparse attention based on content similarity is implemented at the sequence level to effectively model long-range dependencies. This hierarchical strategy optimizes computational complexity to near-linear levels, significantly improving detection efficiency compared to the standard Transformer.

[0027] S3.3 After concatenating the output sequences of global attention calculation and local attention calculation, global average pooling is performed to obtain a fixed-size feature vector. This vector is rich in the contextual information of the entire sequence, providing a highly discriminative feature representation for subsequent classification tasks.

[0028] Compared with the prior art, the advantages of the present invention are as follows:

[0029] (1) A content-aware dynamic sparse attention mechanism is constructed. Through local sensitive hash grouping, anomaly-guided sparsity and hierarchical computing strategies, the computational complexity and number of parameters of the model are greatly reduced, and the real-time performance in the vehicle environment is significantly improved.

[0030] (2) A hierarchical feature enhancement architecture was designed, which combined spatial feature compression of a lightweight convolutional autoencoder with multi-scale temporal statistical feature extraction to achieve deep fusion of message-level and sequence-level features, effectively improving the detection capability of complex covert attacks (Masquerade, Fabrication, etc.).

[0031] (3) By introducing a multi-granularity adaptive classification mechanism and an unknown attack detection module, the system has the ability to continuously perceive and adaptively defend against unknown attacks through dynamic threshold adjustment and online learning strategies, which enhances the generalizability and practicality of the system in actual deployment. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is the overall system architecture diagram of the present invention;

[0034] Figure 2 This is a schematic diagram of the data preprocessing and feature enhancement process in this invention;

[0035] Figure 3This is a structural diagram of the dynamic sparse attention mechanism based on the improved Transformer architecture of this invention;

[0036] Figure 4 This is a confusion matrix diagram of the sample experimental results in this invention. Detailed Implementation

[0037] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. This embodiment is implemented based on the technical solution of the present invention, and provides detailed implementation methods and processes; however, the scope of protection of the present invention is not limited to the following embodiments.

[0038] As attached Figure 1The diagram shown is the overall system architecture of this invention. The system architecture mainly includes a multimodal data preprocessing and hierarchical feature construction module, a message-level deep feature compression and spatiotemporal statistical feature enhancement module, a dynamic sparse attention temporal modeling module, a multi-granularity adaptive classification module, and model deployment and real-time monitoring. This system fully demonstrates the entire process from the input of the original CAN message to the output of the final intrusion detection result, highlighting the data flow and functional cooperation relationship between the modules. The vehicle network intrusion detection system provided by this invention adopts a modular design and includes five core components: (1) Multimodal data preprocessing and hierarchical feature construction module: responsible for receiving the original CAN bus data stream, performing message parsing, field extraction, and data cleaning. This module first performs validity verification on the original message, filtering out invalid or abnormal messages, such as diagnostic messages with CANID greater than 0x700. Then, it performs field segmentation and numerical conversion, decomposing the 11-bit CAN ID into semantic features, dividing the data payload into structural features by bytes, and using logarithmic transformation to normalize the distribution of timestamps, constructing multimodal input features with spatial structure and temporal characteristics. (2) Message-level deep feature compression and spatiotemporal statistical feature enhancement module: Deep feature compression of messages is performed through a lightweight convolutional autoencoder, while extracting multi-scale statistical features in the frequency domain, entropy domain, and time domain. A gated attention mechanism is used to adaptively weight and fuse deep features and statistical features to generate enhanced feature representations with higher information density. (3) Dynamic sparse attention temporal modeling module: Differentiable timestamp coding (DTE) and dynamic sparse attention mechanism (DSA) are integrated. Through local sensitive hash grouping and anomaly-oriented sparse computing strategies, global perception capability is maintained while reducing computational complexity, achieving efficient temporal modeling of CAN message sequences. (4) Multi-granularity adaptive classification module: A hierarchical classifier is used to identify coarse-grained attack types and fine-grained attack subclasses. Combined with a dynamic threshold algorithm based on confidence calibration, deep anomaly detection is initiated for low-confidence samples. (5) Model Deployment and Real-time Monitoring Module: The intrusion detection system operates as follows: Real-time capture of CAN bus messages; Real-time preprocessing and feature enhancement are performed in a window of n messages; Forward inference is performed in the trained lightweight model; The system determines whether an attack exists based on the output results and triggers corresponding alarms or vehicle security protection mechanisms (such as forced speed reduction, prompting the user, etc.).

[0039] S1 and S2, as attached Figure 2The diagram illustrates the data preprocessing and feature enhancement process of this invention. It details the process from parsing the original message, cleaning invalid data, converting field values ​​to numerical values, and finally constructing enhanced samples with temporal statistical features, highlighting the extraction and fusion methods for temporal statistical information. The data processing and feature enhancement of this method include the following specific steps: First, original message parsing is performed, reading message data from the CAN bus or dataset. Each message contains fields such as timestamp, CAN ID, Data Length Code (DLC), and data payload. Integrity verification is performed on the messages, filtering out invalid or abnormal data frames, such as illegal frames with CAN IDs greater than 0x7FF or malformed messages with abnormal payload lengths, ensuring the reliability and standardization of the input data. Simultaneously, non-critical communication data such as diagnostic messages are identified and removed. For messages that pass verification, multi-dimensional feature decomposition is performed. The 11-bit CAN ID is decomposed into semantic features by byte, and the data payload is divided into structural features by 8 bytes, establishing a spatial structure representation of the message. The timestamps are normalized using a logarithmic transformation to address the inherent non-uniform time interval problem in vehicular networks and enhance the model's sensitivity to temporal anomalies. The formula for the logarithmic transformation is as follows:

[0040]

[0041] Where t is the original timestamp, t min The minimum timestamp is α, and α is the smoothing factor (usually taken as 10). -6 ~10 -7 Ultimately, each message possesses 12-dimensional features (4-dimensional ID + 8-dimensional data). Based on this, a fixed-length message sequence is constructed. A sliding window size n (typically 15 or 29) is set to divide consecutive messages into multiple sample sequences. Each sample contains n messages, forming a 12×n-dimensional feature matrix. This step also involves data standardization to eliminate differences in signal dimensions, improving model training stability and convergence efficiency. Furthermore, a dual-channel processing mechanism is employed to extract spatial and temporal features as enhancement information: the spatial feature compression channel uses a lightweight convolutional autoencoder (LCAE) to perform deep feature learning and dimensionality reduction on the message ID and payload; the temporal feature enhancement channel extracts frequency domain, entropy domain, and time domain features through multi-scale temporal statistical methods. This dual-channel parallel processing fully utilizes the inherent and contextual information of the messages.

[0042] Finally, a gated attention mechanism is used to adaptively weight and fuse the dual-channel features, dynamically adjusting the contribution weights of spatial and temporal features to generate an enhanced hybrid feature vector with higher information density, which serves as the input for subsequent models.

[0043] S3, as attached Figure 3The diagram shows the structure of the dynamic sparse attention mechanism based on the improved Transformer architecture used in this invention. This structure, based on the standard Transformer coding layer, uses differentiable timestamp coding (DTE) instead of traditional position coding and introduces dynamic sparse multi-head attention, making it suitable for the resource-constrained environment of automotive embedded devices. The core innovation of this invention lies in designing a dynamic sparse attention mechanism based on the improved Transformer architecture, which significantly improves computational efficiency while maintaining detection accuracy through strategies such as content-aware and locality-sensitive hashing grouping. Specifically, it includes: designing differentiable timestamp coding (DTE) to replace traditional sinusoidal position coding. For the timestamp t of the i-th message in the sequence... i Its position code is calculated as follows:

[0044]

[0045] Where △t i Indicates the time interval between the current message and the previous message. This represents vector concatenation, where σ is the Sigmoid function. This design compresses large interval ranges through logarithmic transformation and normalizes small interval changes through the Sigmoid function, enabling the model to sensitively capture millisecond-level temporal anomalies.

[0046] In addition, DTE introduces learnable scaling parameters α and offset parameters β to dynamically adjust time sensitivity:

[0047] △t adjusted =α·△t+β

[0048] The parameters α and β are optimized through backpropagation during training, enabling the model to adapt to the CAN bus clock characteristics of different vehicles.

[0049] The core innovation of the dynamic sparse attention mechanism lies in abandoning the fixed sparsity pattern and proposing a content-aware sparse mechanism based on anomaly probability. This involves using an improved LSH algorithm adapted to CAN message characteristics, with the following feature hash function:

[0050] h(x) = sign(W) h·x +b h )

[0051] Among them W h The learnable weight matrix is ​​optimized and initialized based on the CAN message ID and payload features. Its dynamic grouping strategy groups messages dynamically based on content similarity, performing full attention calculation within each group and using sparse connections between groups to reduce complexity. Furthermore, an anomaly probability estimator is introduced to dynamically identify suspicious regions and allocate more attention to them. The formula for calculating the attention weights is as follows:

[0052]

[0053] Where Q, K, and V are obtained from the input sequence through different linear transformations, d k Let be the dimension of the key vector. Finally, a "local-global" hierarchical strategy is used for hierarchical attention calculation, which significantly improves efficiency while ensuring accuracy.

[0054] This invention employs a multi-stage training strategy to optimize model performance: the first stage performs basic training using the cross-entropy loss function; the second stage introduces focus loss to address the class imbalance problem; training uses the Adam optimizer with an initial learning rate set to 10. -4 The learning rate is adjusted using a cosine annealing scheduler.

[0055] To verify the effectiveness of this invention, extensive experimental tests were conducted on multiple datasets: such as Figure 4 Test results on the Car-Hacking dataset show a 100% detection rate for four types of attacks: DoS, Fuzzy, Gear Spoofing, and RPM Spoofing, with a false positive rate of less than 0.1%. Experiments on the ROAD dataset demonstrate that the detection performance for Masquerade and Fabrication attacks significantly outperforms existing methods. In particular, a 0% false negative rate was achieved in Masquerade attack detection, proving the effectiveness of the proposed method. Model complexity analysis shows that the number of parameters is only 1 / 10 of the traditional Transformer, reducing computation by approximately 75%, greatly improving the real-time performance of vehicle network intrusion detection. Comparative experiments show that the proposed method outperforms traditional methods in multiple metrics, including detection accuracy, inference speed, and resource consumption, demonstrating the effectiveness and practicality of the innovation.

[0056] Of course, the above description is not intended to limit the present invention, and the present invention is not limited to the examples given above. Any changes, modifications, additions or substitutions made by those skilled in the art within the scope of the present invention should be protected by the present invention.

Claims

1. A vehicular internet of things intrusion detection method based on hierarchical feature enhancement and dynamic sparse attention mechanism, characterized in that, The method comprises the following steps: S1, obtaining original CAN bus message data stream, performing multi-modal data preprocessing and hierarchical feature construction; S2, for hierarchical features, using a dual-channel feature compression mechanism, performing message-level deep feature compression and spatio-temporal statistical feature enhancement to form an enhanced hybrid feature vector; S3, for the enhanced hybrid feature vector, constructing a neural network model based on a content-aware dynamic sparse attention mechanism for feature extraction; S4, inputting the results of sparse attention calculation into a hierarchical classifier to predict and output detection results; S5, training the network model in steps S2 to S4, and deploying the trained network model in a vehicle-mounted embedded device to realize real-time message monitoring and intrusion detection.

2. The method of claim 1, wherein the method is based on hierarchical feature enhancement and dynamic sparse attention mechanism. The step S1 is specifically implemented as follows: obtaining the original CAN bus message data stream, using a hierarchical analysis strategy, first performing validity check and noise filtering on the CAN bus message; then performing multi-granularity feature construction, decomposing the CAN ID into n-byte semantic features, and dividing the data payload into m-byte structural features, the sum of n and m being the CAN ID byte length, and using logarithmic transformation to normalize the timestamp distribution in the message data stream; finally, the continuous messages in the message data stream are segmented into fixed-length time sequences to form a multi-modal sample set with spatial structure and temporal characteristics.

3. The method of claim 2, wherein, The dual-channel feature compression mechanism is used to design a lightweight convolutional autoencoder LCAE for a spatial feature compression channel to process the spliced results of semantic features and structural features; a multi-scale time series statistical model is constructed to extract multi-scale time series statistical features for a time feature enhancement channel, calculate three-dimensional time series features, and adaptively weight and fuse the deep features extracted by the LCAE and the multi-scale time series statistical features to dynamically adjust the importance of each feature dimension through a gated attention mechanism, thereby forming an enhanced hybrid feature vector with higher information density.

4. The method of claim 3, wherein, The step S2 is specifically implemented as follows: S2.1, spatial feature compression channel: for the structural characteristics of the CAN message, a lightweight convolutional autoencoder LCAE is designed, which adopts a hierarchical processing strategy, first splices the semantic features and the structural features, and then performs feature compression through a three-layer convolutional structure; The encoder structure: first, use a depth separable convolutional layer to perform depth convolution, then point-by-point convolution, and finally use a group convolution technique to group the channels, and then splice them after independent convolution in each group; S2.2, time feature enhancement channel: a multi-scale time series statistical feature extraction method is proposed to quantify the time series characteristics of the message stream from three dimensions to obtain multi-scale time series statistical features: S2.3, feature fusion and enhancement: a dynamic fusion strategy based on a gating mechanism is designed; the deep features extracted by the LCAE and the multi-scale time series statistical features are spliced into hybrid features, and then adaptively weighted through a gated attention network to form an enhanced hybrid feature vector.

5. The layered feature enhancement and dynamic sparse attention mechanism based V2X intrusion detection method of claim 4, wherein, The three dimensions in step S2.2 are specifically as follows: The first dimension: frequency domain feature extraction, using sliding window mechanism, calculating the frequency of each CAN ID in the window; for a given time window T t , get the frequency feature vector F t ; Second dimension: entropy domain feature extraction, calculate time window T t Information entropy H(X) of inner message distribution, quantize flow randomness; The third dimension is time domain feature extraction, which calculates the statistical quantity of the time interval of adjacent messages, including mean, variance and skewness, to capture the abnormal fluctuation of message sending rate.

6. The layered feature enhancement and dynamic sparse attention mechanism based V2X intrusion detection method of claim 5, wherein, The content-aware dynamic sparse attention mechanism is specifically: for the enhanced hybrid feature vector, a differentiable timestamp encoding DTE is designed, which maps the time interval information into a position vector through a learnable nonlinear transformation, representing the non-uniform time relationship between messages; Based on the local sensitive hashing LSH grouping algorithm, the position vector is grouped according to the content similarity, and attention calculation is performed within each group; then the sparse mode is dynamically determined according to the sequence content after input attention calculation; finally, a local-global hierarchical attention strategy is adopted, first calculating attention in the local window, and then calculating sparse attention at the global level.

7. The method of claim 6, wherein the method is based on hierarchical feature enhancement and dynamic sparse attention mechanism for V2X intrusion detection. The specific implementation process of the step S3 is as follows: S3.1, for the characteristics of non-uniform time interval between CAN messages, a differentiable timestamp encoding DTE is designed, first, the continuous timestamp is extracted from the preprocessed time sequence of fixed length, and the time interval between adjacent messages is calculated; second, the DTE module maps the time interval into a position vector through a learnable nonlinear transformation layer, injecting absolute and relative time information; finally, the generated position vector is added to the enhanced hybrid feature vector to form a time-aware input representation; S3.2, for the local aggregation characteristics of vehicle network attacks, an abnormal probability-based content-aware sparse mechanism is proposed; first, the time-aware input representation is grouped by local sensitive hashing LSH, and the sequence is divided into multiple groups according to the similarity of message features; global attention calculation is performed within each group, and sparse connection is used between groups; at the same time, the abnormal probability of each message position is calculated in real time, and when the probability exceeds the dynamic threshold, local attention calculation is enabled for the position and its associated area; S3.3, after splicing the output sequences of global attention calculation and local attention calculation, global average pooling is performed to obtain a fixed-size feature vector.

8. The layered feature enhancement and dynamic sparse attention mechanism based V2X intrusion detection method of claim 7, wherein, The hierarchical classifier is implemented by inputting the results of sparse attention calculation into a hierarchical classifier, the first level performs coarse-grained attack type classification, and the second level performs fine-grained attack subclass identification; a dynamic threshold algorithm is proposed to automatically adjust the decision threshold according to real-time traffic characteristics; For sample flows below the threshold, automatically mark as unknown attacks and start the active learning mechanism to continuously improve detection capability.

Images