In-vehicle CAN bus continuous learning intrusion detection method based on variational auto-encoder potential representation and playback fine tuning

Abstract

The invention discloses an in-vehicle CAN bus continuous learning intrusion detection method based on variational auto-encoder potential representation and playback fine tuning, belongs to the technical field of Internet of Vehicles safety, automotive electronics and machine learning, and aims to solve the problems of disastrous forgetting and difficulty in long-term stable operation caused by traditional incremental training in a vehicle-mounted environment. According to the method, hierarchical modeling is carried out on key layer parameters of a CNN model, parameter posterior approximation and a hierarchical variational auto-encoder based on SWAG are introduced, and model parameter distribution of different tasks is fused in a potential space; meanwhile, in combination with typical sample playback and generative parameter reconstruction, a historical task sample and current task data are combined for multi-stage fine tuning, so that the historical task detection performance is kept under the constraint of limited storage and computing resources, and a new scene and a new attack mode are quickly adapted. According to the method, the problem of disastrous forgetting can be effectively relieved, and the stability of the in-vehicle CAN bus intrusion detection system under long-term operation and multi-task scenes is improved.

Description

Technical Field

[0001] This invention belongs to the fields of vehicle network security, automotive electronics, and machine learning technologies. Specifically, it relates to a continuous learning method based on variational autoencoder feature representation for intrusion detection and abnormal behavior recognition of in-vehicle controller area network (CAN) buses. Applicable scenarios include, but are not limited to, passenger cars, commercial vehicles, special-purpose engineering vehicles, and intelligent connected vehicles that use CAN or similar in-vehicle buses. Background Technology

[0002] With the rapid development of automotive electronic and electrical architecture and vehicle-to-everything (V2X) technology, multiple electronic control units (ECUs) within a vehicle are exchanging messages on a large scale through in-vehicle networks such as the CAN bus, making the vehicle's functions increasingly complex. Simultaneously, the openness of external communication interfaces (such as OBD diagnostic ports, in-vehicle Ethernet, cellular communication, and vehicle-to-everything (V2X) terminals) exposes vehicles to various security threats, including remote intrusion, malicious message injection, replay attacks, DoS attacks, and spoofed control commands. If the in-vehicle CAN bus is illegally controlled, the powertrain, braking, and steering systems may be maliciously manipulated, seriously endangering the safety of occupants and the operational safety of the transportation system. Therefore, constructing a high-precision, easily deployable, and long-term online CAN bus intrusion detection system has become an important research direction in the field of V2X security.

[0003] Existing in-vehicle CAN bus intrusion detection methods mainly include traditional rule-based and threshold-based methods, machine learning methods based on statistical features, and data-driven methods based on deep learning. Traditional machine learning models typically rely on manually constructed low-dimensional features, which are difficult to effectively represent the complex high-dimensional payload information and temporal correlations in CAN messages. In recent years, deep learning intrusion detection methods that automatically construct feature representations from raw messages using neural networks have gradually become a research hotspot. However, in practical engineering implementation, the following problems still commonly exist: (1) The distribution of vehicle network data continues to evolve. With the upgrade of vehicle software version, the access of new ECU, the adjustment of control strategy and the change of vehicle use environment, the statistical distribution of normal driving messages and potential attack messages will drift continuously in the time dimension, which will cause the fixed model obtained by offline training to gradually degrade the detection performance under new working conditions and new tasks. A continuous learning mechanism with online adaptability is needed. (2) Traditional incremental updates lead to severe catastrophic forgetting. When introducing new scenarios or new attack patterns, existing methods often only make simple fine-tuning or retraining of the deployed model based on the latest data. Since historical data cannot be completely retained for a long time, this kind of "sequential learning" will cause the model's new knowledge to cover old knowledge, significantly reducing the ability to identify early tasks and historical attack patterns, which is a typical catastrophic forgetting problem; (3) Lack of efficient representation and memory replay mechanism for CAN bus scenarios. Although generative models such as variational autoencoders (VAEs) can compress high-dimensional message features and model the potential spatial distribution of normal behavior, existing work is often only used for static anomaly detection. It lacks a systematic design that is deeply integrated with continuous learning strategies and fails to take into account cross-task knowledge transfer, historical pattern retention and rapid adaptation to new tasks under the constraints of limited storage and computing resources. This restricts the engineering implementation effect of in-vehicle CAN bus intrusion detection system in complex and long-term online environments. Summary of the Invention

[0004] To address the challenges of in-vehicle CAN bus intrusion detection models adapting to changes in data distribution during long-term online operation and the catastrophic forgetting that arises during incremental training, this invention proposes a continuous learning intrusion detection method for CAN bus based on variational autoencoder latent representation and replay fine-tuning. This method utilizes a variational autoencoder to compress and model high-dimensional CAN messages, characterizing typical distribution features under different tasks and operating conditions in the latent space, and constructing typical sample memories and generative replay samples. When introducing new tasks, the model is fine-tuned by combining new data and replay samples, enabling the detection model to adapt to new behavioral patterns while maintaining its ability to identify historical attacks, thereby effectively mitigating catastrophic forgetting under limited storage and computing resources.

[0005] To achieve the above objectives, the technical solution of the present invention is as follows:

[0006] A continuous learning intrusion detection method for in-vehicle CAN bus based on variational autoencoder latent representation and playback fine-tuning includes the following steps: Step 1: Acquisition and processing of in-vehicle CAN bus data; Step 2: Preprocess and partition the dataset; Step 3: Initialize the variational autoencoder and intrusion detection model; Step 4: Train the intrusion detection model using the training set for the current task; Step 5: Train the variational autoencoders of each layer to learn and fuse the features of the model's parameters; Step 6: Use playback to mix typical samples from each task together to fine-tune the hybrid intrusion detection model generated by the variational autoencoder in multiple stages; Step 7: Iterate and evaluate the continuous learning performance in a multi-task scenario until all tasks have been trained.

[0007] The specific details of step one are as follows: CAN bus data of vehicles under different attack tasks are collected through real roads, laboratory benches, or simulation platforms. Normal states and typical attack scenarios such as DoS, fuzzy injection, replay, and forged control commands are recorded simultaneously. The data is organized into multiple sequential learning tasks according to time sequence or application scenario to provide a task-level data foundation for continuous learning.

[0008] The specific details of step two are as follows: preprocessing and dividing the collected CAN bus data; organizing the original CAN frames by time; segmenting continuous messages by a sliding window; normalizing or standardizing the features of each dimension to eliminate differences in units; constructing a sequentially arriving task dataset according to the attack type or time period; and dividing the dataset into training, validation, and test sets within each task to provide a clearly structured data input for model training.

[0009] The specific details of step three are as follows: After completing data preprocessing and task division, the CNN model for CAN bus intrusion detection is initialized, and the time-series data is classified into two categories step by step. For the key layer parameters of the model, the corresponding hierarchical variational autoencoder is initialized, and the SWAG parameter posterior approximation module is introduced to collect and model the parameter distribution of different tasks and training stages, so that the CNN model and the variational autoencoder maintain structural correspondence, providing a foundation for knowledge representation and fusion in the parameter space.

[0010] The specific details of step four are as follows: For each sequential task obtained in step two, the training set of the current task is selected as the data input of the current task and fed into the CNN model initialized in step three for training. During the training process, the prediction results and losses of each sample in different windows are aggregated and statistically analyzed for subsequent performance evaluation.

[0011] The specific details of step five are as follows: After completing the training and parameter sampling of each task model in step four, the parameters of each task model are organized into parameter sample sets according to the first convolutional layer, the second convolutional layer, and the fully connected layer, respectively, and used as the training input of the corresponding layer variational autoencoder. The variational autoencoders of each layer jointly optimize the parameter reconstruction loss, KL divergence loss, old task latent representation replay loss, and reconstruction consistency loss to learn the hierarchical parameter latent distribution under multiple tasks and multiple stages. When a new task arrives, the historical and current task parameter samples are jointly trained to gradually integrate multi-task knowledge into the latent space, thereby obtaining a hierarchical hybrid parameter distribution that can generate shared knowledge.

[0012] The specific details of step six are as follows: After completing the training of each layer of variational autoencoder, samples are taken from its latent space and reconstructed to generate hybrid model parameters that integrate historical and current task information, and a hybrid CNN model is constructed accordingly; at the same time, based on the statistical information in step four, representative typical CAN samples are selected from the data of each task and stored in the buffer. In the new task training stage, historical typical samples are mixed with current task data in proportion to form a replay training set. The hybrid model parameters are used as initialization to perform multi-stage fine-tuning on the model, so as to improve the overall multi-task detection performance while retaining old knowledge as much as possible.

[0013] The specific details of step seven are as follows: In a continuous learning scenario, the process of "model training - hierarchical parameter modeling - variational autoencoder generation - typical sample playback fine-tuning" consisting of steps four to six is ​​treated as a learning cycle. Each task arriving in chronological order is executed sequentially. After each task is completed, the model performance is evaluated on a test set containing both historical and current tasks. Indicators such as accuracy, precision, recall, F1 score, AUC, false negative rate, and false positive rate are calculated to analyze the degree of forgetting and the effectiveness of continuous learning. When the overall performance of the model on multiple tasks meets the preset requirements, the final fused multi-task CAN bus CNN model is output to achieve long-term stable detection under complex working conditions and multi-attack scenarios.

[0014] Compared with the prior art, the beneficial effects of the technical solution of the present invention are: (1) Construct a typical sample memory and generative replay sample set in the latent space to approximately reproduce the feature distribution of each task without retaining the complete original historical data. When training a new task, the replay samples are used together with the current data so that the model can still identify early attack patterns and normal behaviors while learning new attacks and new working conditions, thereby effectively reducing catastrophic forgetting in incremental training; (2) The variational autoencoder performs latent representation learning on CAN messages and extracts common structural features across tasks. Combined with the replay fine-tuning mechanism, when the message distribution drifts over time or new attacks occur, the system can quickly adapt to new task types through incremental updates without forgetting old task knowledge, thereby improving the generalization and robustness in long-term online operation environments; (3) Instead of retaining all historical CAN raw data indefinitely, continuous learning is maintained through two types of compressed representations: First, a hierarchical variational autoencoder is used to model the parameter distribution of convolutional and fully connected layers layer by layer, using fewer parameters to characterize the shared and specific knowledge of multiple tasks; second, a typical sample buffer is used to select a small number of representative CAN samples from each task for subsequent playback training. Compared to storing all data or maintaining independent and complete models for each task, this scheme significantly reduces storage and computational overhead while ensuring continuous learning effectiveness, making it more suitable for long-term online deployment and updates of resource-constrained vehicle ECUs or gateway devices.

[0015] Table 1 shows the performance comparison results of different continuous learning methods under a unified experimental environment. The data indicates that the proposed continuous learning method based on variational autoencoder latent representation and replay fine-tuning (OVTR-CL) achieves the best overall performance. This verifies that the constructed model can effectively overcome catastrophic forgetting and continuously and stably achieve high-precision intrusion detection in dynamically changing in-vehicle CAN bus traffic, significantly improving the long-term safety and adaptability of the system in real-world driving environments.

[0016] Table 1. Performance Comparison Results of Different Continuous Learning Methods Method Name LA BWT EWC 87.09% -0.1710 LwF 86.93% -0.1722 ER 91.70% -0.0501 GEM 92.14% -0.1037 OVTR-CL 99.51% -0.0042 Attached Figure Description

[0017] Figure 1 This is an overall flowchart of the present invention; Figure 2 This invention relates to a continuous learning structure based on the latent representation of a variational autoencoder and replay fine-tuning. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0019] This invention provides a continuous learning intrusion detection method for in-vehicle CAN bus based on variational autoencoder latent representation and replay fine-tuning. Under long-term online operation and multi-tasking scenarios, this method effectively alleviates the catastrophic forgetting problem in traditional incremental training by hierarchically modeling the parameter distribution of the intrusion detection model, memorizing typical samples, and performing multi-stage fine-tuning. This maintains the detection performance against historical attack patterns while improving adaptability to new operating conditions and attack styles, and achieves engineering-deployable continuous learning intrusion detection under limited storage and computing resource constraints.

[0020] Figure 1 This is a flowchart of the method of the present invention. This embodiment fully describes a systematic continuous learning process for in-vehicle CAN bus security. The present invention is mainly divided into 7 steps: (1) CAN bus data acquisition and processing; (2) data preprocessing and dataset partitioning; (3) initialization of intrusion detection model and hierarchical variational autoencoder; (4) training CNN intrusion detection model using training sets of each task and constructing typical sample buffer; (5) training each layer variational autoencoder based on model parameters sampled by layer and reconstructing and fusing model parameters; (6) using the fused parameter model as the initial model, performing multi-stage fine-tuning on the replay training set composed of typical samples and current task data; (7) iteratively executing the above process for each task arriving in time order to achieve continuous updating and optimization of the model;

[0021] The specific implementation steps are as follows: Step 1.1 Collect CAN bus data under different attack tasks in real roads, laboratories or simulation environments, and record fields such as timestamp, CAN_ID, data field and DLC completely, covering a variety of typical operating states, as the original data basis for subsequent training and evaluation; Step 1.2 During the collection process, attack scenarios such as DoS, fuzzy injection, replay, and forged control commands are constructed or recorded simultaneously. Attacks and normal packets are aligned by time and labeled to form a labeled dataset containing multiple attack modes. Step 1.3 Divide the labeled data into multiple sequential learning tasks according to time sequence, scenario, or attack type. Each task corresponds to a specific working condition or attack mode, and maintain an independent data subset and task number to support sequential training and evaluation for continuous learning.

[0022] Step 2.1 Perform unified preprocessing on the original CAN message, including field parsing and cleaning, timestamp normalization or feature transformation, CAN_ID encoding mapping, and DLC normalization verification, to generate a structured record containing time, CAN_ID, data bytes, and DLC; Step 2.2 Expand the data domain into a fixed-dimensional vector, and use a sliding window to divide the time series into fixed-length segments. Then, concatenate the time features, CAN_ID, data vector, and DLC in a unified order to form a three-dimensional sequence tensor. Normalize the features and construct the data loading process for training, validation, and test sets according to the task division.

[0023] Step 3.1 Divide the initial task data into training, validation, and test sets containing normal and multiple types of attacks. Train the intrusion detection model in the order of the tasks. Input all samples in the form of a sliding window to help the model learn the real CAN message distribution and provide reference weights for subsequent parameter modeling. Step 3.2 Construct a variational autoencoder consisting of a multi-layer fully connected network. The encoder maps the key layer parameters of the model to a low-dimensional latent space, the decoder reconstructs the original parameters, and optimizes the latent space by jointly optimizing the reconstruction error and KL divergence, so that the latent space has continuity and generative ability. Step 3.3 Train the intrusion detection model in a supervised manner to distinguish between normal and attack packets. At the same time, extract parameter vectors from each layer, combine Gaussian approximation sampling to generate perturbation samples, and train a corresponding strain sub-encoder to form a smooth distribution in the latent space that can be used for multi-task modeling and fusion.

[0024] Step 4.1 When a new task arrives, the system sequentially inputs its training data and updates the model parameters. The model outputs the anomaly probability and calculates the loss. At the same time, it aggregates multiple prediction results at the sample level to evaluate the overall detection performance of the message or sequence. Step 4.2 Based on the current task data, the system automatically filters representative normal and attack samples by time layer while keeping the normal and attack samples roughly in the preset ratio, forming a compact task memory set for subsequent replay learning and joint fine-tuning.

[0025] Step 5.1 After each task, the system extracts the parameters of each layer of the model and normalizes them. These parameters are then input into the corresponding strain autoencoder along with the parameters of the historical tasks for training or fine-tuning. By aligning the latent representation with the reconstruction results, the knowledge of the old tasks is preserved in both the latent space and the parameter space. Step 5.2 After the variational autoencoder is trained, the system samples and reconstructs in the normalized parameter space to generate a parameter vector that integrates historical and current task information. After inverse normalization and reorganization, the vector is loaded into the new model. At the same time, a control model based only on the current task is retained for performance comparison.

[0026] Step 6.1 Merge typical samples from historical tasks and current tasks into a joint training set in sequence, maintain the balance between normal and attack samples, and assign a global index to the samples to support cross-task performance statistics. Step 6.2 Based on the joint training set, the fusion model is fine-tuned in multiple stages, and the learning rate is gradually optimized by using larger, medium and smaller learning rates in turn. Early stopping, gradient pruning and weight decay are combined to stabilize the performance of old tasks while absorbing new knowledge. Step 6.3 After fine-tuning, evaluate the fusion model and the control model on the validation and test sets of each task, calculate various detection indicators and construct the inter-task performance matrix to obtain the final accuracy and back transfer evaluation results.

[0027] After completing one update process in Step 7.1, the system returns to the task start stage with the updated model, autoencoder, typical sample memory, and normalized statistics. When a new working condition or attack mode occurs, the continuous learning loop from Step 1.1 to Step 6.3 is restarted again, thereby achieving long-term, stable, and adaptive detection of intrusion behavior on the vehicle's CAN bus with low storage and computing costs.

[0028] Figure 2 This invention presents a continuous learning structure based on variational autoencoder latent representation and replay fine-tuning. This structure is divided into three functional regions from top to bottom: "knowledge acquisition," "knowledge fusion," and "knowledge reconstruction." Through parameter distribution modeling, hierarchical variational autoencoder latent representation, and typical sample memory working together, a continuously iterative learning framework is formed as the task sequence arrives. With this structure, the intrusion detection model can effectively retain historical task knowledge while continuously receiving new tasks, mitigating the catastrophic forgetting inherent in traditional incremental training.

[0029] The specific implementation steps are as follows: Step 1.1 First Stage: Knowledge Acquisition. For each task arriving in chronological order... First, the intrusion detection CNN model is trained independently using the training data corresponding to this task. After the model converges, the parameter tensors of each key network layer are expanded into layer-by-layer parameter vectors. Based on the norm and statistical properties of the current parameter vectors, to approximate the parameter uncertainty under this task, an isotropic Gaussian perturbation is constructed for each layer parameter vector, and its sampling form is defined as: This perturbation sampling is used to replace explicit posterior modeling as the input data source for layer-by-layer VAE training. During model training, the absolute values ​​of the loss gradients for each parameter across all mini-batches are accumulated to measure the sensitivity of the parameters to task performance and to construct the weights of key parameters. ; Step 1.2 Second Stage: Knowledge Integration. First, after training the CNN model for the current task, extract the parameter vectors of each layer from the model. To avoid implicit forgetting caused by inconsistent parameter scales across different tasks, the parameters are standardized: ,in and The parameters are statistically analyzed in the first task and kept constant in subsequent tasks. This ensures that parameters from different tasks are modeled in the same standardized space, thus avoiding implicit forgetting caused by cross-task scale drift. For each network layer, an independent variational autoencoder is constructed to model the latent distribution of the standardized parameter vector. The encoding and reparameterization process is represented as follows: To minimize the parameter reconstruction error and strengthen the constraints on important parameters of historical tasks through key parameter weights, the reconstruction loss is defined as: Building upon this, in order to robustly integrate the multi-task parameter distributions in the latent space, three key regularization terms are further introduced: (1) For each old task By using the parameter vectors saved from the old task and their corresponding old VAEs, the representation of the old task in the latent space can be obtained. Simultaneously, input the same parameter into the VAE of the current task to obtain... By minimizing the difference between the two, the potential distribution of the current VAE on the old task parameters is made consistent with the historical distribution. The loss is defined as: ,in As a potential dimension, This loss indexes the old tasks. It aligns the current VAE's latent space with the latent space of the old tasks, effectively preventing the destruction of the old task's latent structure during training of the new task. (2) For each old task The same old task parameter vector is reconstructed using both the old VAE and the current VAE, yielding the reconstruction results. By minimizing the mean squared error between the two, the current VAE inherits the old VAE's ability to reconstruct old task parameters; the loss is defined as: ,in The number of old tasks participating in the constraint. This represents the parameter dimension of this layer. By minimizing the loss from reconstructing old knowledge, we ensure that the model can still accurately reconstruct the parameters of historical tasks as new tasks arrive. (3) For the key intermediate layer, the mean vector of all old tasks in the latent space of this layer is first used as the history center. Then calculate the potential mean of the current task in the same layer. And minimize the Euclidean distance between them: The potential spatial center alignment loss is calculated, and by aligning the overall distribution centers of the old and new tasks at the potential spatial level, the stability of cross-task parameter distribution is further improved. Finally, in the second stage, the overall optimization objective of each layer of VAE can be expressed as: By jointly optimizing the reconstruction loss and KL divergence loss with the above three regularization terms, the distribution of multi-task parameters in the latent space is kept structurally stable, thereby achieving continuous preservation and fusion of historical task knowledge. Step 1.3 Third Stage: Knowledge Reconstruction. After completing layer-by-layer VAE training, the current model parameters are reconstructed and fused. The reconstructed, standardized parameters are mapped back to the original parameter space and inserted back into the CNN model. After parameter reconstruction, a sample buffer is constructed using typical samples from each task, and the model is fine-tuned in multiple stages on this buffer to gradually adapt to the joint distribution of multiple tasks. Through the above-mentioned joint mechanism of "parameter distribution reconstruction + key parameter protection + limited sample replay", a fused multi-task intrusion detection model is finally obtained, which effectively suppresses catastrophic forgetting while ensuring the performance of new tasks.

Claims

1. A continuous learning intrusion detection method for in-vehicle CAN bus based on variational autoencoder latent representation and replay fine-tuning, characterized in that... Includes the following steps: Step 1: Acquisition and processing of in-vehicle CAN bus data; Step 2: Preprocess and partition the dataset; Step 3: Initialize the variational autoencoder and intrusion detection model; Step 4: Train the intrusion detection model using the training set for the current task; Step 5: Train the variational autoencoders of each layer to learn and fuse the features of the model's parameters; Step 6: Use playback to mix typical samples from each task together to fine-tune the hybrid intrusion detection model generated by the variational autoencoder in multiple stages. Step 7: Iterate and evaluate the continuous learning performance in a multi-task scenario until the preset indicators are reached.

2. The in-vehicle CAN bus continuous learning intrusion detection method based on variational autoencoder latent representation and replay fine-tuning as described in claim 1, characterized in that... The specific details of Step 1 are as follows: CAN bus data of vehicles under different attack tasks are collected through real roads, laboratory benches or simulation platforms. Normal state and typical attack scenarios such as DoS, fuzzy injection, replay and forged control commands are recorded simultaneously. The data is organized into multiple sequential learning tasks according to time sequence or application scenario to provide a task-level data foundation for continuous learning.

3. The in-vehicle CAN bus continuous learning intrusion detection method based on variational autoencoder latent representation and replay fine-tuning as described in claim 1, characterized in that: The specific process in Step 2 is as follows: preprocessing and dividing the collected CAN bus data; organizing the original CAN frames according to time; segmenting continuous messages through a sliding window; normalizing or standardizing the features of each dimension to eliminate differences in units; constructing a sequentially arriving task dataset according to the attack type or time period; and dividing the dataset into training set, validation set and test set within each task to provide a clearly structured data input for model training.

4. The in-vehicle CAN bus continuous learning intrusion detection method based on variational autoencoder latent representation and replay fine-tuning as described in claim 1, characterized in that: The specific process in Step 3 is as follows: After completing data preprocessing and task division, the CNN model for CAN bus intrusion detection is initialized, and the time-series data is classified into two categories step by step. For the key layer parameters of the model, the corresponding hierarchical variational autoencoder is initialized, and the SWAG parameter posterior approximation module is introduced to collect and model the parameter distribution of different tasks and training stages, so that the CNN model and the variational autoencoder maintain structural correspondence, providing a foundation for knowledge representation and fusion in the parameter space.

5. The in-vehicle CAN bus continuous learning intrusion detection method based on variational autoencoder latent representation and replay fine-tuning as described in claim 1, characterized in that: The specific process in Step 4 is as follows: For each sequential task obtained in Step 2, the training set of the current task is selected as the data input of the current task and sent to the CNN model initialized in Step 3 for training. During the training process, the prediction results and losses of each sample in different windows are aggregated and statistically analyzed for subsequent performance evaluation.

6. The in-vehicle CAN bus continuous learning intrusion detection method based on variational autoencoder latent representation and replay fine-tuning as described in claim 1, characterized in that: The specific process in Step 5 is as follows: After completing the training and parameter sampling of each task model in Step 4, the parameters of each task model are organized into parameter sample sets according to the first convolutional layer, the second convolutional layer, and the fully connected layer, respectively, as the training input of the corresponding layer variational autoencoder. The variational autoencoders of each layer jointly optimize the parameter reconstruction loss, KL divergence loss, old task latent representation replay loss, and reconstruction consistency loss to learn the hierarchical parameter latent distribution under multiple tasks and multiple stages. When a new task arrives, the historical and current task parameter samples are jointly trained to gradually integrate multi-task knowledge into the latent space, thereby obtaining a hierarchical hybrid parameter distribution that can generate shared knowledge.

7. The in-vehicle CAN bus continuous learning intrusion detection method based on variational autoencoder latent representation and replay fine-tuning according to claim 1, characterized in that: The specific process in Step 6 is as follows: After completing the training of each layer of variational autoencoder, samples are taken from its latent space and reconstructed to generate hybrid model parameters that integrate historical and current task information, and a hybrid CNN model is constructed accordingly; at the same time, based on the statistical information in Step 4, representative typical CAN samples are selected from the data of each task and stored in the buffer. In the new task training stage, the historical typical samples and the current task data are mixed in proportion to form a replay training set. The hybrid model parameters are used as initialization to perform multi-stage fine-tuning on the model, so as to improve the overall multi-task detection performance while retaining old knowledge as much as possible.

8. The in-vehicle CAN bus continuous learning intrusion detection method based on variational autoencoder latent representation and replay fine-tuning according to claim 1, characterized in that: The specific process in Step 7 is as follows: In the continuous learning scenario, the process of "model training - hierarchical parameter modeling - variational autoencoder generation - typical sample playback fine-tuning" consisting of Step 4 to Step 6 is regarded as a learning cycle. Each task that arrives in time is executed sequentially. After each task is completed, the model performance is evaluated on the test set containing the history and current tasks, and the accuracy, precision, recall, F1, AUC and false negative rate and false positive rate are calculated to analyze the degree of forgetting and the effect of continuous learning. When the model's overall performance on multiple tasks meets the preset requirements, the final fused multi-task CAN bus CNN model is output, enabling long-term stable detection under complex working conditions and multiple attack scenarios.

Images