Method, device and equipment for detecting attack on CAN bus and storage medium

Abstract

The application discloses a CAN bus attack detection method and device, equipment and a storage medium, and relates to the technical field of network security. The method comprises the following steps: extracting multi-scale features from historical message data transmitted by a vehicle CAN bus; training a plurality of candidate detection models based on the multi-scale features; selecting a target detection model from the plurality of candidate detection models based on multi-dimensional evaluation indexes of the plurality of candidate detection models; and determining an attack detection result of a to-be-transmitted message based on the target detection model. In the foregoing manner, multi-scale features capable of covering all attack types are introduced, abnormal conditions of different attacks are accurately captured, the trained detection model can be effectively applied to all attack types, meanwhile, a plurality of candidate models are trained, and the optimal model is selected from the plurality of candidate models for attack detection, so that the detection accuracy is improved, and the missed detection rate is effectively reduced.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to CAN bus attack detection methods, devices, equipment, and storage media. Background Technology

[0002] In the era of intelligent connected vehicles, the CAN bus, as the communication nerve center of the vehicle's electronic control unit (ECU), is of paramount importance in terms of security. However, traditional CAN bus attack detection methods typically rely on simple rules or single machine learning models, making it difficult to effectively address increasingly complex emerging threats such as fuzzy attacks and denial-of-service (DoS) attacks. Furthermore, normal CAN bus messages constitute a large proportion, while attack samples such as DoS, fuzzy attacks, and gear spoofing are relatively few. Traditional accuracy metrics cannot measure the model's ability to identify rare attack samples, resulting in a very high false negative rate in actual deployments. In addition, existing detection schemes mostly use general temporal or statistical features, which cannot accurately characterize the personalized patterns of communication between different ECUs, making it difficult to identify specific types of spoofing attacks (such as RPM spoofing targeting a specific ID).

[0003] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention

[0004] The main purpose of this application is to provide a CAN bus attack detection method, apparatus, device and storage medium, which aims to solve the technical problem of high false negative rate in traditional attack detection schemes in the prior art.

[0005] To achieve the above objectives, this application provides a CAN bus attack detection method, the method comprising: Extracting multi-scale features from historical message data transmitted on the vehicle's CAN bus; Based on the aforementioned multi-scale features, multiple candidate detection models are trained. Based on the multi-dimensional evaluation metrics of the multiple candidate detection models, a target detection model is selected from the multiple candidate detection models. Based on the target detection model, the attack detection result of the message to be transmitted is determined.

[0006] In one embodiment, the step of extracting multi-scale features from historical message data transmitted from the vehicle CAN bus includes: The historical message data transmitted on the vehicle's CAN bus is resampled to obtain resampled message data. The historical message data includes normal traffic message data and attack message data. The resampled message data is standardized into message feature data, and training message data is selected from the message feature data; Feature extraction is performed on the training message data to obtain multi-scale features, including sliding window smoothing features, wavelet transform features, time window frequency features, CAN smoothing features, multi-step time-series difference features, window statistics features, information entropy features, Hamming distance sequence features, CAN-specific Hamming features, and arrival interval time features.

[0007] In one embodiment, the step of extracting features from the training message data to obtain multi-scale features includes: The training message data is smoothed using a sliding window to obtain the sliding window smoothing feature. The training message data is subjected to discrete wavelet decomposition, and the coefficients obtained from the decomposition are used as wavelet transform features. The frequency characteristics of the time window are determined based on the frequency of occurrence of the CAN identifier within the preset time window. Based on the mean value of the training message data corresponding to the same CAN identifier within the preset time window, the CAN smoothing feature is determined. Based on the feature differences between training message data within the preset time window, multi-step temporal difference features are determined. Based on the mean deviation, standard deviation, and standardization deviation of the training message data corresponding to the same CAN identifier within the preset time window, the window statistical characteristics are determined. Based on the Shannon entropy, normalized entropy, unique byte ratio, zero byte ratio, and byte standard deviation of the training message data, the information entropy characteristics are determined. Based on the Hamming distance between consecutive messages in the training message data, a Hamming distance sequence is determined, and based on the statistical characteristics of the Hamming distance sequence, the characteristics of the Hamming distance sequence are determined. Based on the average Hamming distance, standard deviation, and Hamming distance bias of the training message data, CAN-specific Hamming features are obtained. The arrival interval time feature is determined based on the time difference between training message data corresponding to the same CAN identifier.

[0008] In one embodiment, the method further includes: Obtain the target detection scene; Based on the target detection scenario, a time window configuration strategy is determined; Based on the time window configuration strategy, a preset time window is determined.

[0009] In one embodiment, the step of training multiple candidate detection models based on the multi-scale features includes: Multiple candidate combinations are selected from the candidate model library, and the candidate combinations include a first preset model and a second preset model; Based on the multi-scale features, the first preset model is trained to obtain the corresponding first candidate detection model; Based on the feature importance scores of the multi-scale features output by the first candidate detection model, the corresponding target features are selected from the multi-scale features; Based on the target features corresponding to the first candidate detection model, the second preset model corresponding to the first candidate detection model is trained to obtain the second candidate detection model corresponding to the first candidate detection model. Based on the first candidate detection model and the second candidate detection model corresponding to the first candidate detection model, multiple combined models are obtained, and the multiple combined models are used as multiple candidate detection models respectively.

[0010] In one embodiment, the step of selecting the target detection model from the plurality of candidate detection models based on the multi-dimensional evaluation index of the plurality of candidate detection models further includes: Based on the multiple candidate detection models, the verification message data is processed to obtain the verification output results of each candidate detection model; Based on the validation output results of each candidate detection model, multi-dimensional evaluation metrics for each candidate detection model are calculated. These multi-dimensional evaluation metrics include accuracy, macro-average harmonic mean, recall, macro-average recall, and AUC value.

[0011] In one embodiment, after the step of determining the attack detection result of the packet to be detected based on the target detection model, the method further includes: Based on the attack detection results, a threat probability index for the target attack category is determined; Obtain the correspondence between asset value indicators, threat probability indicators, vulnerability indicators and attack risk values, and obtain the asset value indicators and vulnerability indicators of the message transmission target; Based on the asset value assignment of the message transmission target, the threat probability index of the target attack category, the vulnerability index of the message transmission target, and the corresponding relationship, the attack risk value of the message transmission target is obtained. Based on the attack risk value of the message transmission target, a security defense strategy for the message transmission target is generated.

[0012] Furthermore, to achieve the above objectives, this application also proposes a CAN bus attack detection device, which includes: The feature extraction module is used to extract multi-scale features from historical message data transmitted on the vehicle's CAN bus. The model training module is used to train multiple candidate detection models based on the multi-scale features; The model training module is also used to select a target detection model from the multiple candidate detection models based on the multi-dimensional evaluation index of the multiple candidate detection models; An attack detection module is used to determine the attack detection result of the message to be transmitted based on the target detection model.

[0013] In addition, to achieve the above objectives, this application also proposes a CAN bus attack detection device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor. The computer program is configured to implement the steps of the CAN bus attack detection method described above.

[0014] In addition, to achieve the above objectives, the present invention also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the CAN bus attack detection method described above.

[0015] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the CAN bus attack detection method described above.

[0016] This application provides a CAN bus attack detection method. It extracts multi-scale features from historical message data transmitted on a vehicle's CAN bus; trains multiple candidate detection models based on these features; selects a target detection model from among the candidate models based on multi-dimensional evaluation metrics; and determines the attack detection result of the message to be transmitted based on the target detection model. This application introduces multi-scale features that cover all attack types, accurately capturing anomalies in different attacks, enabling the trained detection model to be effectively applied to all attack types. Furthermore, by training multiple candidate models and selecting the optimal model for attack detection, it can adapt to data of different scales and categories, improving detection accuracy and effectively reducing the false negative rate, thus solving the technical problem of high false negative rates in traditional attack detection schemes. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating an embodiment of the CAN bus attack detection method of this application. Figure 2 This is a flowchart illustrating Embodiment 2 of the CAN bus attack detection method of this application; Figure 3 This is a flowchart illustrating Embodiment 3 of the CAN bus attack detection method of this application; Figure 4 This is a schematic diagram of the module structure of the CAN bus attack detection device according to an embodiment of this application; Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the CAN bus attack detection method in this application embodiment.

[0020] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0021] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0022] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0023] The main solution of this application embodiment is: extracting multi-scale features from historical message data transmitted by the vehicle CAN bus; training multiple candidate detection models based on the multi-scale features; selecting a target detection model from the multiple candidate detection models based on the multi-dimensional evaluation index of the multiple candidate detection models; and determining the attack detection result of the message to be transmitted based on the target detection model.

[0024] Currently, traditional CAN bus attack detection schemes typically rely on simple rules or single machine learning models, making them ineffective against increasingly complex emerging threats such as fuzzy attacks and denial-of-service (DoS) attacks. Furthermore, traditional schemes generally suffer from limitations such as single-dimensional feature extraction, poor robustness to imbalanced data, and insufficient model generalization ability.

[0025] This application provides a solution that introduces multi-scale features that can cover all attack types, accurately captures anomalies in different attacks, and enables the trained detection model to be effectively applied to all attack types. At the same time, multiple candidate models are trained, and the optimal model is selected for attack detection. This can adapt to data of different scales and categories, improve detection accuracy, effectively reduce the false negative rate, and solve the technical problem of high false negative rate in traditional attack detection schemes.

[0026] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device capable of performing the above functions, such as a CAN bus attack detection device. This embodiment does not specifically limit it in this way. The following uses a CAN bus attack detection device as an example to describe this embodiment and the following embodiments.

[0027] This application provides a CAN bus attack detection method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the CAN bus attack detection method of this application.

[0028] In this embodiment, the CAN bus attack detection method includes steps S10~S40: Step S10: Extract multi-scale features from the historical message data transmitted on the vehicle's CAN bus. It should be noted that historical message data refers to CAN messages transmitted by the vehicle's electronic control unit (ECU) via the CAN bus. In this embodiment, historical message data includes normal traffic message data and attack message data. Normal traffic message data refers to CAN messages transmitted normally, while attack message data refers to CAN messages that have been attacked. Attack message data covers at least the following attack types: denial-of-service attack, fuzzy attack, gear spoofing attack, and speed spoofing (RPM) attack.

[0029] Additionally, it should be noted that historical message data needs to be preprocessed accordingly. For example, the timestamp, CAN ID, data length code (DLC), and data field (up to 8 bytes) of each message should be uniformly filled to a fixed length, and a corresponding tag should be assigned to each message.

[0030] Understandably, multi-scale features refer to multi-dimensional features extracted from historical message data, capable of covering all attack types. Specifically, multi-scale features can include sliding window smoothing features, wavelet transform features, time window frequency features, CAN smoothing features, multi-step temporal difference features, window statistical features, information entropy features, Hamming distance sequence features, CAN-specific Hamming features, and arrival interval time features.

[0031] Step S20: Based on the multi-scale features, train multiple candidate detection models; It should be noted that the candidate detection model is a detection model that is considered as a candidate. In this embodiment, multiple candidate detection models will be trained using multi-scale features, so that the most suitable model can be found among these candidate detection models as the final detection model.

[0032] Understandably, candidate detection models can be single models or combined models (obtained by combining two or more models). Generally, if the final detection model needs to be a single model, multiple single models are trained as candidate detection models; if the final detection model needs to be a combined model, multiple combined models are trained as candidate detection models.

[0033] It should be understood that the base model used for training can be selected from a pre-defined candidate model library, which includes models such as LightGBM, XGBoost, Random Forest, and Extra-Trees.

[0034] In one feasible implementation, step S20 may include steps S201 to S205: Step S201: Select multiple candidate combinations from the candidate model library, wherein the candidate combinations include a first preset model and a second preset model; It should be noted that the candidate combination refers to the combination of base models selected from the candidate model library, including a first preset model and a second preset model. Generally, the first preset model and the second preset model are usually different models. For example, the first preset model is XGBoost and the second preset model is LightGBM; or the first preset model is LightGBM and the second preset model is a random forest model.

[0035] Step S202: Based on the multi-scale features, train the first preset model respectively to obtain the corresponding first candidate detection model; Understandably, multi-scale features are used to train all selected first-preset models, and the resulting model is the first candidate detection model. The value of f1 is chosen as the loss function to make the model more biased towards the evaluation metric of improving imbalanced samples.

[0036] In this embodiment, the input of the first candidate detection model is multi-scale features, and the output is the feature importance score of the multi-scale features. The feature importance score is an indicator used to characterize the importance of multi-scale features. The higher the feature importance score, the more important the corresponding multi-scale feature is.

[0037] Step S203: Based on the feature importance scores of the multi-scale features output by the first candidate detection model, select the corresponding target features from the multi-scale features; It should be understood that the target feature is the most important feature selected. In specific implementation, the multi-scale features can be sorted in descending order according to their feature importance scores, so that the top-ranked features can be selected as the target features according to a pre-set selection number (K); alternatively, a score threshold can be set, and features with feature importance scores greater than or equal to this score threshold can be selected as the target features.

[0038] Step S204: Based on the target features corresponding to the first candidate detection model, train the second preset model corresponding to the first candidate detection model to obtain the second candidate detection model corresponding to the first candidate detection model. It is understandable that different first candidate detection models usually correspond to different target features. According to the target features corresponding to the first candidate detection model, the corresponding second preset model is trained, and the model obtained after training is the second candidate detection model.

[0039] Step S205: Based on the first candidate detection model and the second candidate detection model corresponding to the first candidate detection model, a plurality of combined models are obtained, and the plurality of combined models are respectively used as a plurality of candidate detection models.

[0040] It should be understood that the first candidate detection model and the second candidate detection model corresponding to the first candidate detection model can be used as a combined model, thereby determining all combined models and thus obtaining all candidate detection models.

[0041] Step S30: Select the target detection model from the multiple candidate detection models based on the multi-dimensional evaluation index of the multiple candidate detection models; It should be noted that multi-dimensional evaluation metrics are indicators used to evaluate candidate detection models across multiple dimensions. Multi-dimensional evaluation metrics include accuracy, macro-mean harmonic mean, recall, macro-mean recall, and AUC.

[0042] In one feasible implementation, before step S30, the following steps may be included: processing the verification message data based on the plurality of candidate detection models to obtain the verification output results of each candidate detection model; and calculating the multi-dimensional evaluation index of each candidate detection model based on the verification output results of each candidate detection model.

[0043] It should be noted that the verification message data is the dataset used for verification, which is usually a portion of the historical message data. The verification output refers to the output obtained after inputting the verification message data into the candidate detection model.

[0044] It is understandable that accuracy is the proportion of correct verification output results, and the calculation formula is:

[0045] In the formula, This indicates the actual number of attack packets (any type of DoS / Fuzzy / gear spoofing / RPM spoofing), which the model also determines as the number of attack packets. This indicates that the actual number of messages were normal CAN messages, and the model also determined that the number of messages were normal CAN messages. This indicates the number of messages that were actually normal CAN messages but were mistakenly identified as attack messages by the model. This represents the number of CAN messages that were actually attack messages but were incorrectly identified as normal CAN messages by the model. Accuracy is usually more reliable when the positive and negative samples are balanced. However, since CAN attack data is usually extremely imbalanced (anomalies <1%), it is difficult to accurately find the most suitable detection model using only accuracy as an evaluation metric. Therefore, this embodiment additionally introduces macro-average harmonic mean, recall, macro-average recall, and AUC value to evaluate the model.

[0046] It should be understood that the harmonic mean of precision and recall is the F1 score, calculated as follows:

[0047] In the formula, Indicates accuracy rate. Indicates recall rate, This represents the F1 score. Precision refers to the proportion of packets identified as attacks that are actually attack packets. It measures the accuracy of the model in identifying attacks and prevents normal packets from being misclassified as attacks. The calculation formula is: The F1 score is more reliable than accuracy in imbalanced data. The macro-mean harmonic mean, which is the macro-mean of the F1 score, is calculated as follows:

[0048] In the formula, This represents the macro-average harmonic mean. Indicates the total number of attack categories. Indicates the first The F1 score for each attack category. Recall refers to the proportion of actual attack packets that are successfully detected by the model, mainly measuring the model's ability to control missed attacks. The calculation formula is shown below:

[0049] In the formula, Indicates recall rate, This indicates that the actual packets are attack packets, and the model also determines this as the number of attack packets. This represents the number of CAN messages that were actually attack messages but were mistakenly identified as normal messages by the model. The macro-average recall rate is the macro-average of the recall rate, and its calculation relationship is shown below:

[0050] In the formula, Indicates the macro average recall rate. Indicates the total number of attack categories. Indicates the first The recall rate for each attack category. The AUC (Area Under ROC Curve) value, which is the area under the ROC (Receiver Operating Characteristic Curve), can measure the overall discriminative ability of the model at different thresholds. It does not depend on the classification threshold and is more robust in cases of class imbalance.

[0051] Step S40: Based on the target detection model, determine the attack detection result of the message to be transmitted.

[0052] It should be noted that the target detection model is the final model used for attack detection. The message to be transmitted is the CAN message that needs to be detected for attack, and the attack detection result is the detection result of the message to be transmitted.

[0053] Understandably, by extracting the corresponding multi-scale features from the message to be transmitted and inputting them into the target detection model, the attack detection result of the message to be transmitted can be obtained.

[0054] This embodiment provides a CAN bus attack detection method. It extracts multi-scale features from historical message data transmitted on a vehicle's CAN bus; trains multiple candidate detection models based on these features; selects a target detection model from among the candidate models based on multi-dimensional evaluation metrics; and determines the attack detection result of the message to be transmitted based on the target detection model. This embodiment introduces multi-scale features that cover all attack types, accurately capturing anomalies in different attacks. This ensures the trained detection model is effectively applicable to all attack types. Furthermore, by training multiple candidate models and selecting the optimal model for attack detection, it can adapt to data of different scales and categories, improving detection accuracy and effectively reducing the false negative rate.

[0055] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 Step S10 may include steps S101 to S103: Step S101: Resample the historical message data transmitted on the vehicle's CAN bus to obtain resampled message data; It should be noted that this embodiment performs independent resampling on different types of datasets (normal traffic packet data and attack packet data) to support balanced sampling or custom imbalanced sampling strategies. Specifically, when using each type of data, it is opened independently, the target number of rows is calculated independently, and the data is truncated independently, without interference. The resampled packet data is the historical packet data after resampling.

[0056] Step S102: Standardize the resampled message data into message feature data, and select training message data from the message feature data; It should be noted that the message data fields (except for the timestamp) of the resampled message data are converted from hexadecimal strings to decimal integers and sorted according to the timestamp, thereby completing the data standardization and obtaining message feature data.

[0057] Understandably, the message feature data will be divided into a training set and a test set to prevent data leakage. The ratio can be set to 7:3, but this embodiment does not specify a particular ratio. The training set is the data used to train the model, i.e., the training message data, while the test set is the data used to validate the model, i.e., the validation message data.

[0058] Step S103: Extract features from the training message data to obtain multi-scale features.

[0059] In one feasible implementation, step S103 may include steps A10 to A19: Step A10: Smooth the training message data based on a sliding window to obtain the sliding window smoothing feature; It should be noted that the sliding window smoothing feature can suppress sensor noise or momentary jitter and highlight long-term trends. Normal CAN messages have periodicity or quasi-periodity, and their characteristic values ​​(such as vehicle speed and RPM) change smoothly. However, fuzzy attacks inject random bytes, causing the characteristics to jump drastically.

[0060] Understandably, weighted or unweighted sliding windows can be used to smooth all training message data. The unweighted calculation method is shown below:

[0061] In the formula, Indicates the smoothing feature of the sliding window. This represents the sequence number (or index) of the current message, usually an integer. Indicates the size of the sliding window (e.g., 3, 5, 10 messages), usually a positive integer. Indicates the first The raw characteristic values ​​of a message (such as the value of byte 0, vehicle speed, etc.) are usually real numbers or integers.

[0062] Step A11: Perform discrete wavelet decomposition on the training message data and use the decomposed coefficients as wavelet transform features. It should be noted that wavelet transform features can capture local mutations and multi-scale structures of byte sequences from a frequency domain perspective. Normal message byte patterns are stable (e.g., state machine switching), and wavelet coefficient energy is concentrated; attack messages (e.g., fuzzy messages) have random bytes, and high-frequency coefficients have enhanced energy.

[0063] It is understandable that the Discrete Wavelet Transform (DWT) is performed on the 8-byte vector of each training message data, that is, the approximation coefficients (low frequency) and detail coefficients (high frequency) are output, and the approximation coefficients and detail coefficients are concatenated to form new features, that is, the wavelet transform features are obtained.

[0064] Step A12: Determine the frequency characteristics of the time window based on the frequency of occurrence of the CAN identifier within the preset time window; It should be noted that the frequency of CAN identifier occurrence within the preset time window refers to the number of times the same CAN ID appears within the preset time window before the current message timestamp. The frequency of CAN identifier occurrence within the preset time window is used as the time window frequency feature.

[0065] Step A13: Determine the CAN smoothing feature based on the mean value of the training message data corresponding to the same CAN identifier within the preset time window; Understandably, within a preset time window, the average value of the feature values ​​of messages with the same CAN ID is calculated and used as the CAN smoothing feature.

[0066] Step A14: Determine multi-step temporal difference features based on the feature differences between training message data within the preset time window; It should be noted that multi-step temporal differences can capture short-term dynamic anomalies. Normal packets show minimal changes between adjacent frames, while attack frames may be unrelated to previous frames.

[0067] It should be understood that, within a preset time window, the k most recent messages with the same CAN ID as the current message (e.g., the previous 3 messages) are found, and the difference in feature values ​​between the current message and these k messages is calculated respectively. The feature difference between the training message data is obtained and used as the multi-step time-series difference feature.

[0068] Step A15: Determine the window statistical characteristics based on the mean deviation, standard deviation, and standardization deviation of the training message data corresponding to the same CAN identifier within the preset time window; It should be noted that Intra-CAN-ID Statistics can quantify the degree of deviation of the current value from the local history. The standardized deviation (absolute Z-score) can effectively identify sudden anomalies (such as injected forged messages), and generally, the larger the standardized deviation value, the more abnormal it is.

[0069] Understandably, within a preset time window, the mean, variance, and standard deviation of the characteristic values ​​of messages with the same CAN ID are calculated, and the deviation of the current value from the mean (mean deviation) and the absolute value of the Z-Score are further calculated. The formula for calculating the mean deviation is: , This represents the mean deviation. This is a single characteristic scalar of the current message (such as the value of byte 3). This represents the average of messages with the same CAN ID. The formula for calculating the degree of normalization deviation is: , To standardize the degree of deviation, The standard deviation of messages with the same CAN ID. To prevent small constants from being divided by zero, .

[0070] Step A16: Determine the information entropy characteristics based on the Shannon entropy, normalized entropy, unique byte ratio, zero byte ratio, and byte standard deviation of the training message data; It should be noted that information entropy is used to measure the randomness and information content of byte data. Normal message bytes often contain repeated / fixed fields (low entropy).

[0071] Understandably, for each training message's 8 bytes of data, its Shannon entropy, normalized entropy, unique byte ratio, zero byte ratio, and byte standard deviation are calculated using the following formulas:

[0072]

[0073]

[0074]

[0075] In the formula, Represents Shannon entropy. Represents the normalized entropy. Indicates the unique byte ratio, Indicates the zero-byte ratio. This represents the bytes of the current message. , Represents a set of byte values ​​(without duplicates). , Represents byte value Frequency of occurrence .

[0076] Step A17: Based on the Hamming distance between consecutive messages in the training message data, determine the Hamming distance sequence; based on the statistical characteristics of the Hamming distance sequence, determine the characteristics of the Hamming distance sequence. It should be noted that Hamming distance features can measure the similarity of adjacent message content. Normal ECU message content changes gradually (small Hamming distance), while fuzzy / DoS attacks cause large differences between adjacent frames.

[0077] It is understandable that consecutive messages in the training message data refer to adjacent messages in the training message data. Grouped by CAN ID, the Hamming distance between consecutive messages is calculated to form a Hamming distance sequence. A sliding window statistical analysis is then performed on this sequence to generate multiple statistical features, including mean, standard deviation, percentiles, rate of change, and outlier Z-score, which serve as the features of the Hamming distance sequence.

[0078] Step A18: Based on the average Hamming distance, standard deviation, and Hamming distance deviation of the training message data, obtain the CAN-specific Hamming features; Understandably, the average Hamming distance and standard deviation of all historical messages corresponding to each CAN ID are calculated, and the deviation of the current Hamming distance from the average value is calculated, i.e., the Hamming distance deviation. These features are then used as CAN-specific Hamming features.

[0079] Step A19: Determine the arrival interval time feature based on the time difference between training message data corresponding to the same CAN identifier.

[0080] It should be noted that the Interval of Arrival (IAT) feature can detect anomalies in time behavior. CAN messages have a strict periodicity, and attacks can disrupt this periodicity (e.g., DoS attacks can cause IAT≈0, while replay attacks can cause IAT to be abnormally high).

[0081] Understandably, the time difference between consecutive messages with the same CAN ID (i.e., the time difference between the current message and the previous message with the same CAN ID) is calculated, and the mean, standard deviation, maximum / minimum value, and count of IAT are statistically analyzed within the time window as arrival interval time characteristics.

[0082] It should be understood that, in practice, the multi-scale features comprise a total of 128 dimensions.

[0083] In specific implementations, for DoS attacks, the typical manifestations are a decrease in IAT, an increase in frequency, and an increase in Hamming distance (if random frames are injected). For Fuzzy attacks, the typical manifestations are an increase in entropy, an increase in Hamming distance, an increase in Z-score, and an increase in wavelet high-frequency energy. For RPM / Gear attacks, the typical manifestations are changes in IAT, multi-step differential anomalies, and statistical deviations. For replay attacks, the typical manifestations are abnormal IAT, a decrease in Hamming distance (same as historical frames), and abnormal frequency.

[0084] Furthermore, the target detection scene is obtained; based on the target detection scene, a time window configuration strategy is determined; and based on the time window configuration strategy, a preset time window is determined.

[0085] It should be noted that the preset time window is a configurable parameter used to dynamically adapt to CAN bus communication modes under different vehicle speeds or network loads. Target detection scenarios refer to actual application scenarios where attack detection is required. For different application scenarios, the corresponding preset time window has different detection capabilities for different network security attacks, employing different configuration methods (time window configuration strategies). For example, in scenarios involving high-speed driving or idling, sufficiently dense sampling is needed to capture rapidly changing transient features, so a medium-to-small window is set; in urban congestion or idling (low speed / stationary) scenarios, sufficient frames need to be accumulated to observe low-frequency changing patterns, so a larger window is set; in normal communication or scenarios with DDoS / Flood attacks (affected by network load), an adaptive frame rate window is used to more easily detect anomalies through comparison.

[0086] This embodiment provides a CAN bus attack detection method. It resamples historical message data transmitted on the vehicle's CAN bus to obtain resampled message data. The historical message data includes normal traffic message data and attack message data. The resampled message data is standardized into message feature data, and training message data is selected from this feature data. Feature extraction is performed on the training message data to obtain multi-scale features. This embodiment introduces multi-scale features that can cover all attack types, accurately capturing anomalies in different attacks. This allows the trained detection model to be effectively applied to all attack types. Furthermore, by training multiple candidate models and selecting the optimal model for attack detection, it can adapt to data of different scales and categories, improving detection accuracy and effectively reducing the false negative rate.

[0087] Based on the first embodiment of this application, in the third embodiment of this application, the same or similar content as the above embodiment can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 3 Step S40 may be followed by steps S501 to S504: Step S501: Based on the attack detection results, determine the threat probability index of the target attack category; It should be noted that the target attack category refers to the attack category that needs to be focused on at present. It can cover all attack categories, or multiple categories can be selected as the target attack category.

[0088] Understandably, the threat probability index can directly use the recall value of the target detection model.

[0089] Step S502: Obtain the correspondence between asset value indicators, threat probability indicators, vulnerability indicators and attack risk values, and obtain the asset value indicators and vulnerability indicators of the message transmission target. It should be noted that the message transmission target refers to the ECU associated with the message to be transmitted. The asset value index is a numerical value used to measure the asset value of the message transmission target. For the asset value index of the message transmission target, the ISO21434 standard or SAE J3061 standard can be referenced, and a value should be assigned based on the physical object controlled by the ECU, such as: very low / low / medium / high / critical, or 1-5 points. The vulnerability index is a numerical value used to measure the vulnerability level of the message transmission target. For the vulnerability index of the message transmission target, expert experience and the GB-20984 standard can be referenced, and a value should be assigned based on whether a specific attack type is effective against a specific message transmission target, and the ease of exploitation, such as: very low / low / medium / high / critical, or 1-5 points.

[0090] Understandably, the correspondence between asset value indicators, threat probability indicators, vulnerability indicators, and attack risk values—that is, the formula for calculating attack risk values—is as follows:

[0091] In the formula, Indicates the first Under the attack category, the first The attack risk value of the target message transmission. Indicates the first Asset value indicators of a message transmission target. Indicates the first The threat probability index for the attack category indicates the likelihood of the attack. Under the attack category, the first Vulnerability indicators for each message transmission target.

[0092] Step S503: Based on the asset value assignment of the message transmission target, the threat probability index of the target attack category, the vulnerability index of the message transmission target, and the corresponding relationship, the attack risk value of the message transmission target is obtained. Understandably, by assigning the asset value of the message transmission target, the threat probability index of the target attack category, and the vulnerability index of the message transmission target to the above correspondence, the attack risk value of the message transmission target can be calculated.

[0093] Step S504: Based on the attack risk value of the message transmission target, generate a security defense strategy for the message transmission target.

[0094] As can be understood, a security defense strategy refers to the relevant strategies used to defend against attacks. A security defense strategy for the message transmission target is generated based on the attack risk value of the target message.

[0095] This embodiment provides a CAN bus attack detection method. Based on the attack detection results, it determines the threat probability index of the target attack category; obtains the correspondence between asset value index, threat probability index, vulnerability index, and attack risk value, and obtains the asset value index and vulnerability index of the message transmission target; based on the asset value assignment of the message transmission target, the threat probability index of the target attack category, the vulnerability index of the message transmission target, and the correspondence, it obtains the attack risk value of the message transmission target; based on the attack risk value of the message transmission target, it generates a security defense strategy for the message transmission target. This embodiment introduces multi-scale features that can cover all attack types, accurately captures anomalies of different attacks, and enables the trained detection model to be effectively applied to all attack types. Simultaneously, it trains multiple candidate models and selects the optimal model for attack detection, adapting to data of different scales and categories, improving detection accuracy, and effectively reducing the false negative rate.

[0096] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the CAN bus attack detection method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0097] This application also provides a CAN bus attack detection device; please refer to [reference needed]. Figure 4 The CAN bus attack detection device includes: Feature extraction module 10 is used to extract multi-scale features from historical message data transmitted from the vehicle CAN bus; The model training module 20 is used to train multiple candidate detection models based on the multi-scale features; The model training module 20 is also used to select a target detection model from the multiple candidate detection models based on the multi-dimensional evaluation index of the multiple candidate detection models; The attack detection module 30 is used to determine the attack detection result of the message to be transmitted based on the target detection model.

[0098] In one feasible implementation, the feature extraction module 10 is further configured to resample the historical message data transmitted on the vehicle CAN bus to obtain resampled message data, wherein the historical message data includes normal traffic message data and attack message data. The resampled message data is standardized into message feature data, and training message data is selected from the message feature data; Feature extraction is performed on the training message data to obtain multi-scale features, including sliding window smoothing features, wavelet transform features, time window frequency features, CAN smoothing features, multi-step time-series difference features, window statistics features, information entropy features, Hamming distance sequence features, CAN-specific Hamming features, and arrival interval time features.

[0099] In one feasible implementation, the feature extraction module 10 is further configured to smooth the training message data based on a sliding window to obtain sliding window smoothing features. The training message data is subjected to discrete wavelet decomposition, and the coefficients obtained from the decomposition are used as wavelet transform features. The frequency characteristics of the time window are determined based on the frequency of occurrence of the CAN identifier within the preset time window. Based on the mean value of the training message data corresponding to the same CAN identifier within the preset time window, the CAN smoothing feature is determined. Based on the feature differences between training message data within the preset time window, multi-step temporal difference features are determined. Based on the mean deviation, standard deviation, and standardization deviation of the training message data corresponding to the same CAN identifier within the preset time window, the window statistical characteristics are determined. Based on the Shannon entropy, normalized entropy, unique byte ratio, zero byte ratio, and byte standard deviation of the training message data, the information entropy characteristics are determined. Based on the Hamming distance between consecutive messages in the training message data, a Hamming distance sequence is determined, and based on the statistical characteristics of the Hamming distance sequence, the characteristics of the Hamming distance sequence are determined. Based on the average Hamming distance, standard deviation, and Hamming distance bias of the training message data, CAN-specific Hamming features are obtained. The arrival interval time feature is determined based on the time difference between training message data corresponding to the same CAN identifier.

[0100] In one feasible implementation, the feature extraction module 10 is further used to acquire the target detection scene; Based on the target detection scenario, a time window configuration strategy is determined; Based on the time window configuration strategy, a preset time window is determined.

[0101] In one feasible implementation, the model training module 20 is further configured to select multiple candidate combinations from the candidate model library, the candidate combinations including a first preset model and a second preset model; Based on the multi-scale features, the first preset model is trained to obtain the corresponding first candidate detection model; Based on the feature importance scores of the multi-scale features output by the first candidate detection model, the corresponding target features are selected from the multi-scale features; Based on the target features corresponding to the first candidate detection model, the second preset model corresponding to the first candidate detection model is trained to obtain the second candidate detection model corresponding to the first candidate detection model. Based on the first candidate detection model and the second candidate detection model corresponding to the first candidate detection model, multiple combined models are obtained, and the multiple combined models are used as multiple candidate detection models respectively.

[0102] In one feasible implementation, the model training module 20 is further configured to process the verification message data based on the plurality of candidate detection models to obtain the verification output results of each candidate detection model. Based on the validation output results of each candidate detection model, multi-dimensional evaluation metrics for each candidate detection model are calculated. These multi-dimensional evaluation metrics include accuracy, macro-average harmonic mean, recall, macro-average recall, and AUC value.

[0103] In one feasible implementation, the attack detection module 30 is further configured to determine a threat probability index of the target attack category based on the attack detection result. Obtain the correspondence between asset value indicators, threat probability indicators, vulnerability indicators and attack risk values, and obtain the asset value indicators and vulnerability indicators of the message transmission target; Based on the asset value assignment of the message transmission target, the threat probability index of the target attack category, the vulnerability index of the message transmission target, and the corresponding relationship, the attack risk value of the message transmission target is obtained. Based on the attack risk value of the message transmission target, a security defense strategy for the message transmission target is generated.

[0104] The CAN bus attack detection device provided in this application employs the CAN bus attack detection method described in the above embodiments, which can solve the technical problem of high false negative rates in traditional attack detection schemes. Compared with the prior art, the beneficial effects of the CAN bus attack detection device provided in this application are the same as those of the CAN bus attack detection method provided in the above embodiments, and other technical features in the CAN bus attack detection device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0105] This application provides a CAN bus attack detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the CAN bus attack detection method in the first embodiment described above.

[0106] The following is for reference. Figure 5 This document illustrates a structural schematic diagram of a CAN bus attack detection device suitable for implementing embodiments of this application. The CAN bus attack detection device in this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 5 The CAN bus attack detection device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0107] like Figure 5As shown, the CAN bus attack detection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in ROM (Read Only Memory) 1002 or a program loaded from storage device 1003 into RAM (Random Access Memory) 1004. RAM 1004 also stores various programs and data required for the operation of the CAN bus attack detection device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via bus 1005. Input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touch screens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the CAN bus attack detection device to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows CAN bus attack detection devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0108] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0109] The CAN bus attack detection device provided in this application employs the CAN bus attack detection method described in the above embodiments, which can solve the technical problem of high false negative rates in traditional attack detection schemes. Compared with the prior art, the beneficial effects of the CAN bus attack detection device provided in this application are the same as those of the CAN bus attack detection method provided in the above embodiments, and other technical features of this CAN bus attack detection device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0110] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0111] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0112] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the CAN bus attack detection method in the above embodiments.

[0113] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0114] The aforementioned computer-readable storage medium may be included in the CAN bus attack detection device; or it may exist independently and not be assembled into the CAN bus attack detection device.

[0115] The aforementioned computer-readable storage medium carries one or more programs. When the aforementioned one or more programs are executed by the CAN bus attack detection device, the CAN bus attack detection device: extracts multi-scale features from the historical message data transmitted by the vehicle's CAN bus; trains multiple candidate detection models based on the multi-scale features; selects a target detection model from the multiple candidate detection models based on the multi-dimensional evaluation indicators of the multiple candidate detection models; and determines the attack detection result of the message to be transmitted based on the target detection model.

[0116] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0117] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0118] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0119] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described CAN bus attack detection method, thereby solving the technical problem of high false negative rates in traditional attack detection schemes. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the CAN bus attack detection method provided in the above embodiments, and will not be repeated here.

[0120] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the CAN bus attack detection method described above.

[0121] The computer program product provided in this application can solve the technical problem of high false negative rate in traditional attack detection schemes. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the CAN bus attack detection method provided in the above embodiments, and will not be repeated here.

[0122] The above are only some embodiments of this application and do not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A method for detecting CAN bus attacks, characterized in that, The method includes: Extracting multi-scale features from historical message data transmitted on the vehicle's CAN bus; Based on the aforementioned multi-scale features, multiple candidate detection models are trained. Based on the multi-dimensional evaluation metrics of the multiple candidate detection models, a target detection model is selected from the multiple candidate detection models. Based on the target detection model, the attack detection result of the message to be transmitted is determined.

2. The method as described in claim 1, characterized in that, The steps for extracting multi-scale features from historical message data transmitted from the vehicle CAN bus include: The historical message data transmitted on the vehicle's CAN bus is resampled to obtain resampled message data. The historical message data includes normal traffic message data and attack message data. The resampled message data is standardized into message feature data, and training message data is selected from the message feature data; Feature extraction is performed on the training message data to obtain multi-scale features, including sliding window smoothing features, wavelet transform features, time window frequency features, CAN smoothing features, multi-step time-series difference features, window statistics features, information entropy features, Hamming distance sequence features, CAN-specific Hamming features, and arrival interval time features.

3. The method as described in claim 2, characterized in that, The step of extracting features from the training message data to obtain multi-scale features includes: The training message data is smoothed using a sliding window to obtain the sliding window smoothing feature. The training message data is subjected to discrete wavelet decomposition, and the coefficients obtained from the decomposition are used as wavelet transform features. The frequency characteristics of the time window are determined based on the frequency of occurrence of the CAN identifier within the preset time window. Based on the mean value of the training message data corresponding to the same CAN identifier within the preset time window, the CAN smoothing feature is determined. Based on the feature differences between training message data within the preset time window, multi-step temporal difference features are determined. Based on the mean deviation, standard deviation, and standardization deviation of the training message data corresponding to the same CAN identifier within the preset time window, the window statistical characteristics are determined. Based on the Shannon entropy, normalized entropy, unique byte ratio, zero byte ratio, and byte standard deviation of the training message data, the information entropy characteristics are determined. Based on the Hamming distance between consecutive messages in the training message data, a Hamming distance sequence is determined, and based on the statistical characteristics of the Hamming distance sequence, the characteristics of the Hamming distance sequence are determined. Based on the average Hamming distance, standard deviation, and Hamming distance bias of the training message data, CAN-specific Hamming features are obtained. The arrival interval time feature is determined based on the time difference between training message data corresponding to the same CAN identifier.

4. The method as described in claim 3, characterized in that, The method further includes: Obtain the target detection scene; Based on the target detection scenario, a time window configuration strategy is determined; Based on the time window configuration strategy, a preset time window is determined.

5. The method as described in claim 1, characterized in that, The step of training multiple candidate detection models based on the multi-scale features includes: Multiple candidate combinations are selected from the candidate model library, and the candidate combinations include a first preset model and a second preset model; Based on the multi-scale features, the first preset model is trained to obtain the corresponding first candidate detection model; Based on the feature importance scores of the multi-scale features output by the first candidate detection model, the corresponding target features are selected from the multi-scale features; Based on the target features corresponding to the first candidate detection model, the second preset model corresponding to the first candidate detection model is trained to obtain the second candidate detection model corresponding to the first candidate detection model. Based on the first candidate detection model and the second candidate detection model corresponding to the first candidate detection model, multiple combined models are obtained, and the multiple combined models are used as multiple candidate detection models respectively.

6. The method as described in claim 1, characterized in that, Before the step of selecting the target detection model from the multiple candidate detection models using the multi-dimensional evaluation index based on the multiple candidate detection models, the following further includes: Based on the multiple candidate detection models, the verification message data is processed to obtain the verification output results of each candidate detection model; Based on the validation output results of each candidate detection model, multi-dimensional evaluation metrics for each candidate detection model are calculated. These multi-dimensional evaluation metrics include accuracy, macro-average harmonic mean, recall, macro-average recall, and AUC value.

7. The method as described in claim 6, characterized in that, After determining the attack detection result of the packet to be detected based on the target detection model, the method further includes: Based on the attack detection results, a threat probability index for the target attack category is determined; Obtain the correspondence between asset value indicators, threat probability indicators, vulnerability indicators and attack risk values, and obtain the asset value indicators and vulnerability indicators of the message transmission target; Based on the asset value assignment of the message transmission target, the threat probability index of the target attack category, the vulnerability index of the message transmission target, and the corresponding relationship, the attack risk value of the message transmission target is obtained. Based on the attack risk value of the message transmission target, a security defense strategy for the message transmission target is generated.

8. A CAN bus attack detection device, characterized in that, The device includes: The feature extraction module is used to extract multi-scale features from historical message data transmitted on the vehicle's CAN bus. The model training module is used to train multiple candidate detection models based on the multi-scale features; The model training module is also used to select a target detection model from the multiple candidate detection models based on the multi-dimensional evaluation index of the multiple candidate detection models; An attack detection module is used to determine the attack detection result of the message to be transmitted based on the target detection model.

9. A CAN bus attack detection device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the CAN bus attack detection method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the CAN bus attack detection method as described in any one of claims 1 to 7.

Images