A method, system, and device for vehicle-to-everything (V2X) intrusion detection based on multi-scale ConvLSTM.

Abstract

This invention discloses a method, system, and device for vehicle-to-everything (V2X) intrusion detection based on multi-scale ConvLSTM, relating to the field of V2X network security technology. The invention includes: acquiring V2X traffic table data, sequentially performing encoding and normalization preprocessing to convert it into a format suitable for model input; extracting multi-scale features in parallel by setting multi-scale dilated convolutional modules with different dilation rates to capture representational information of different feature combinations; inputting the features at each scale into a ConvLSTM module for spatiotemporal encoding to achieve efficient feature fusion; and finally outputting classification results through a fully connected layer. This invention can comprehensively capture multi-scale feature patterns in traffic data, improve the representational ability of different network behaviors, and simultaneously achieve lightweight and efficient feature fusion, reducing the computational burden on the model and adapting to scenarios with limited vehicle terminal resources.

Description

Technical Field

[0001] This invention relates to the field of vehicle network security technology, specifically to a vehicle network intrusion detection method, system, and device based on multi-scale ConvLSTM. Background Technology

[0002] With the rapid development of autonomous driving technology, Vehicle-to-Everything (VANETs) has become a core component of intelligent transportation systems. Currently, VANET intrusion detection mainly relies on extracting tabular data features from network traffic, such as source address, packet length, connection duration, and protocol type, to identify attacks. However, existing detection methods have significant drawbacks: they only focus on local information in traffic features, failing to fully consider the differences in how different feature combinations represent different network behaviors, and thus cannot comprehensively capture the complex multi-scale feature patterns in VANET traffic. Furthermore, existing methods lack lightweight and efficient multi-scale feature fusion mechanisms, often employing direct splicing to fuse features. This not only results in poor fusion performance but also increases the computational load of the model, leading to low accuracy and high false negative rates in detecting dynamically changing intrusion behaviors, making it difficult to adapt to the complex and ever-changing application scenarios of VANETs.

[0003] Therefore, this invention proposes a method, system, and device for vehicle network intrusion detection based on multi-scale ConvLSTM. Summary of the Invention

[0004] The purpose of this invention is to provide a method, system, and device for vehicle network intrusion detection based on multi-scale ConvLSTM, so as to solve the problems mentioned in the background art.

[0005] According to a first aspect of the present invention, in order to achieve the above-mentioned objective, the present invention provides the following technical solution: a vehicle network intrusion detection method based on multi-scale ConvLSTM, comprising the following steps: Receive vehicle network traffic table data and preprocess the table data to convert it into a two-dimensional feature matrix of uniform size. The table data includes source address, destination address, packet length, connection duration, protocol type, and number of error segments. A multi-scale dilated convolutional network is constructed. A two-dimensional feature matrix is ​​input into the multi-scale dilated convolutional network to extract feature maps of multiple different scales and generate a multi-scale feature set. The multi-scale dilated convolutional network includes multiple dilated convolutional branches with different dilation rates, and the multiple dilated convolutional branches run in parallel to extract features of different scales. A lightweight feature fusion facilitator is constructed based on the ConvLSTM architecture. The features of each scale in the multi-scale feature set are input into the lightweight feature fusion facilitator as independent time steps. Spatiotemporal coding fusion is performed through a gating mechanism of forget gate, input gate, and output gate to output fused features. The fused features of the output are input into a pre-constructed classification output network. The classification output network outputs the classification result through linear transformation and activation function to complete the intrusion detection. The classification output network is constructed using a fully connected layer, which includes multiple hidden layers and an output layer.

[0006] Furthermore, the system receives vehicle network traffic table data and preprocesses the table data to convert it into a uniform-sized two-dimensional feature matrix, as follows: The categorical features in the table data are converted into numerical features using one-hot encoding, while the numerical features retain their original values, resulting in the encoded data. The encoded dataset is normalized using the Min-Max normalization method, mapping all feature values ​​to the [0,1] interval to obtain the normalized data; The eigenvectors in the normalized data are padded with zeros to convert them into a two-dimensional feature matrix of uniform size, and the two-dimensional feature matrix is ​​output.

[0007] Furthermore, the one-hot encoding satisfies the following condition: Suppose a certain type of feature has The first of the different categories, this feature The value of the nth sample is the nth kind, Then its one-hot encoding result satisfy: in, Dimension index of the encoded vector ( Numerical features retain their original values, and after encoding, a unified numerical dataset is obtained. , This represents the total dimension of the encoded features.

[0008] Furthermore, the encoded data is normalized using the Min-Max normalization method, as follows: For the encoded dataset The first in Features , its first Normalization results for each sample The calculation formula is: in, For the encoded number The sample, the first The values ​​of each feature, , The first The minimum and maximum values ​​of each feature are normalized to obtain the data. .

[0009] Furthermore, the eigenvectors in the normalized data are padded with zeros to convert them into two-dimensional feature matrices of uniform size, as follows: Let the target input size be If the dimension of the normalized single-sample feature vector is The zero-padding operation is represented as: in, For feature height, For feature width, For the normalized first The feature vector of each sample This is a zero-padding function; after zero-padding, the single-sample two-dimensional feature matrix... After padding all samples with zeros, the resulting two-dimensional feature matrix is ​​represented as follows: .

[0010] Furthermore, a multi-scale dilated convolutional network is constructed. The two-dimensional feature matrix is ​​input into the multi-scale dilated convolutional network to extract feature maps of multiple different scales, generating a multi-scale feature set, as follows: Parameter definition: The void ratios of each branch are respectively ,satisfy Furthermore, there is no common divisor greater than 1 between any two void rates; Each branch uses a convolution kernel of the same size. , The convolution kernel side length is , and the number of convolution kernels is . The activation function used is the ReLU function; Dilated convolution operation: For the first One branch, Corresponding to void ratio Its convolution operation formula is: in, Indicates the void ratio dilated convolution operation, For the first Bias vectors of each branch For the first Feature maps output by each branch; Multi-scale feature set acquisition: After T branches perform dilated convolution operations in parallel, they output T feature maps of different scales, which are then integrated to form a multi-scale feature set. .

[0011] Furthermore, a lightweight feature fusion processor is constructed based on the ConvLSTM architecture. Features at each scale in the multi-scale feature set are input into the lightweight feature fusion processor as independent time steps. Spatiotemporal encoding fusion is performed through a gating mechanism involving a forget gate, input gate, and output gate to output fused features, as detailed below: Parameter definition: The lightweight feature fusion unit includes Hidden layers, each with a dimension of [missing information]. ; Let the input be a multi-scale feature set. After dimensional adjustment ,in To simulate timing step size, and The number of scales is consistent, and each simulation time step corresponds to A unique feature at different scales. The feature dimension for each simulation time step; the hidden state is... , For hidden layer index, Cell state is ; Multi-scale feature fusion is achieved through the synergistic effect of the forget gate, input gate, and output gate. The computation process is as follows: in, , , These are the input gate, forget gate, and output gate, respectively, and the feature flow is controlled by the Sigmoid activation function. Candidate cell state, In cellular state, Output features for the current time step; The multi-scale fusion feature input is given at time step t, where t = 1, 2, ..., T; , It is a 3×3 convolution weight matrix. , Equal to the bias term; ⊙ represents a two-dimensional convolution operation, and ⊙ represents an element-wise multiplication operation. Fusion feature output: after After processing the hidden layers of ConvLSTM, the hidden states of each layer are taken as the fused features of multi-scale features. .

[0012] Furthermore, the fused output features are input into a pre-constructed classification output network. The classification output network outputs the classification result through linear transformation and activation function, as follows: Fully connected layers include There are one hidden layer and one output layer. Let the first hidden layer be the first output layer. A hidden layer, The number of nodes is The number of output layer nodes is The hidden layer activation function uses the ReLU function, and the output layer activation function uses the softmax function. Linear transformation and activation of hidden layers: The input to the first hidden layer is the fused feature output by ConvLSTM, and the input to subsequent hidden layers is the output of the previous hidden layer. The calculation formula for each hidden layer is: in, , For the first The weight matrix of each hidden layer For the first The bias vectors of each hidden layer For the first The output of each hidden layer; Output layer classification: The output layer receives the output of the last hidden layer, performs a linear transformation and softmax activation, and outputs the probability distribution of each category. The formula is as follows: in, The weight matrix of the output layer. This is the bias vector for the output layer. For the prediction probability matrix, Indicates the first The sample belongs to the first The probability of a class; Classification result determination: The category with the highest predicted probability is taken as the final classification result for the sample, using the following formula: in, For the first The classification labels of each sample are used to complete intrusion detection.

[0013] According to a second aspect of the present invention, the present invention provides a vehicle network intrusion detection system based on multi-scale ConvLSTM, for implementing the vehicle network intrusion detection method based on multi-scale ConvLSTM described in the first aspect, comprising: The data preprocessing module is used to receive the vehicle network traffic table data and preprocess the table data to convert it into a two-dimensional feature matrix of uniform size. The table data includes source address, destination address, packet length, connection duration, protocol type, and number of error segments. The multi-scale feature extraction module is used to construct a multi-scale dilated convolutional network. The two-dimensional feature matrix is ​​input into the multi-scale dilated convolutional network to extract feature maps of multiple different scales and generate a multi-scale feature set. The multi-scale dilated convolutional network includes multiple dilated convolutional branches with different dilation rates, and the multiple dilated convolutional branches run in parallel to extract features of different scales. The ConvLSTM fusion module is used to build a lightweight feature fusion unit based on the ConvLSTM architecture. It takes the features of each scale in the multi-scale feature set as independent time steps and inputs them into the lightweight feature fusion unit. It performs spatiotemporal coding fusion through a gating mechanism of forget gate, input gate, and output gate to output fused features. The classification output module is used to input the fused features of the output into a pre-constructed classification output network. The classification output network outputs the classification result through linear transformation and activation function to complete the intrusion detection. The classification output network is constructed using a fully connected layer, which includes multiple hidden layers and an output layer.

[0014] According to a third aspect of the present invention, the present invention provides a terminal device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein when the processor loads and executes the computer program, it employs the vehicle-to-everything (V2X) intrusion detection method based on multi-scale ConvLSTM described in the first aspect.

[0015] This invention has at least the following beneficial effects: 1. This invention effectively expands the receptive field without increasing the number of convolution kernel parameters by setting multiple parallel convolutional branches with different dilation rates, enabling the model to simultaneously capture fine-grained local connectivity features and coarse-grained global traffic patterns. This multi-scale feature extraction mechanism gives the model a stronger ability to identify intrusion types with complex behavioral patterns, such as denial-of-service attacks and remote-to-local attacks, fundamentally improving the completeness and discriminative power of the feature space.

[0016] 2. This invention innovatively introduces ConvLSTM into the multi-scale feature fusion stage, utilizing its simulated spatiotemporal coding gating mechanism to treat features at different scales as temporal sequences for correlation modeling. Through the synergistic effect of the forget gate, input gate, and output gate, adaptive selection and dynamic fusion of multi-scale features are achieved. While preserving key spatial structure information, the model size is effectively controlled. This design enables the model to run efficiently in the resource-constrained hardware environment of in-vehicle terminals and has good adaptability for engineering deployment.

[0017] 3. This invention uses the features at each scale in the multi-scale feature set as independent time steps to input into the ConvLSTM module. Through iterative updates of cell state and hidden state, a nonlinear correlation between fine-grained features and coarse-grained features is established. This spatiotemporal encoding method enables the model to learn the inherent mapping rules between different feature combinations and network behavior categories, strengthens the robustness of identifying dynamic intrusion patterns, and effectively reduces the risk of missed detection in complex network environments.

[0018] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the method described in this invention; Figure 2 This is a schematic diagram of the method described in this invention; Figure 3 This is the evaluation matrix of the classification prediction results in the embodiments of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] Example 1: Please see Figure 1 This invention provides a technical solution: a vehicle network intrusion detection method based on multi-scale ConvLSTM, comprising the following steps: Step 1: Obtain the vehicle network traffic table data. The table data contains various characteristics, such as source address, destination address, packet length, connection duration, protocol type, number of error segments, etc. Let the original traffic table data be the dataset. ,in For the sample size, For feature dimensions (i.e., each sample contains) The table data is sequentially encoded, normalized, and padded with zeros (each feature is represented by a specific feature matrix), ultimately converting it into a two-dimensional feature matrix that fits the model input, as detailed below: Step 1-1 Encoding: For categorical features in the table (such as protocol type, connection status flags), use one-hot encoding to convert them into numerical features to ensure the model can handle them. Let a certain categorical feature have... The first of the different categories, the feature The value of the nth sample is the nth kind( Then its one-hot encoding result satisfy: (1) in, Dimension index of the encoded vector ( Numerical features retain their original values, and after encoding, a unified numerical dataset is obtained. , This represents the total dimension of the encoded features; Step 1-2 Normalization: The Min-Max normalization method is used to eliminate the dimensional differences between different features and map all feature values ​​to the [0,1] interval to ensure that each feature contributes equally to the model training. For the encoded dataset The first in Features , its first Normalization results for each sample The calculation formula is: (2) in, For the encoded number The sample, the first The values ​​of each feature, , The first The minimum and maximum values ​​of each feature are obtained, and after normalization, the dataset is obtained. ; Steps 1-3 Zero-padding transformation: To adapt to the input requirements of the multi-scale dilated convolution module, the normalized feature vectors are padded with zeros and transformed into a two-dimensional feature matrix of uniform size; Let the target input size be , For feature height, The feature width is , if the dimension of the normalized single-sample feature vector is . The zero-padding operation can be represented as: (3) in, For the normalized first The feature vector of each sample This is a zero-padding function; after zero-padding, the single-sample two-dimensional feature matrix... The model input dataset is obtained by padding all samples with zeros. ; Step 2: Construct a multi-scale dilated convolutional network. Input the two-dimensional feature matrix into the multi-scale dilated convolutional network to extract feature maps of multiple different scales and generate a multi-scale feature set. The multi-scale dilated convolution module sets up T dilated convolution branches with different dilation rates (T≥3) to extract features at different scales in parallel and capture the representational information of different feature combinations. Details are as follows: Step 2-1 Parameter Definition: The void ratios of each branch are respectively (satisfy (And there is no common divisor greater than 1 between any two void ratios to avoid the mesh effect); each branch uses a convolution kernel of the same size. , The convolution kernel side length is [value], and the number of convolution kernels (output channels) is [value]. The activation function used is the ReLU function; Step 2-2 Dilated Convolution Operation: Dilated convolution expands the receptive field of convolution by inserting zero values ​​between the elements of the convolution kernel, without increasing the size of the convolution kernel or the amount of computation. For the Branches ( Corresponding to void ratio Its convolution operation formula is: (4) in, Indicates the void ratio dilated convolution operation, For the first Bias vectors of each branch For the first Feature maps output by each branch; Step 2-3: Obtaining the Multi-Scale Feature Set: After T branches perform dilated convolution operations in parallel, they output T feature maps at different scales, which are then integrated to form a multi-scale feature set. This prepares for subsequent feature fusion; This feature set contains complete multi-scale information ranging from fine-grained local features to meso-scale features to coarse-grained global features. Subsequently, the features at each scale in this feature set are used as independent time steps and input into the ConvLSTM module for feature fusion. Step 3: Construct a lightweight feature fusion machine based on the ConvLSTM architecture. Input the features of each scale in the multi-scale feature set as independent time steps into the lightweight feature fusion machine. Perform spatiotemporal coding fusion through the gating mechanism of forget gate, input gate, and output gate to output fused features. The multi-scale feature set output by the multi-scale dilated convolution module The input is fed into the ConvLSTM module, which acts as a lightweight feature fusion unit. Leveraging the gating mechanism of analog spatiotemporal coding, it... The model performs correlation modeling and fusion of independent scale features, replacing the traditional direct splicing fusion method. This reduces the computational cost of the model while ensuring the fusion effect. The detailed structure is as follows: Step 3-1 Parameter Definition: The ConvLSTM module contains Hidden layers, each with a dimension of [missing information]. Let the input be a multi-scale feature set. After dimensional adjustment ,in To simulate timing step size, and The number of scales is consistent, and each simulation time step corresponds to A unique feature at different scales. The feature dimension for each simulation time step; the hidden state is... , For hidden layer index ( ), cell state is .

[0023] Step 3-2 ConvLSTM Structure: ConvLSTM achieves multi-scale feature fusion through the synergistic effect of the forget gate, input gate, and output gate. Core computation process: (5) in, , , These are the input gate, forget gate, and output gate, respectively, and the feature flow is controlled by the Sigmoid activation function. Candidate cell state, In cellular state, Output features for the current time step; The multi-scale fusion feature input at time step t (t=1,2,...,T); , The weights are 3×3 convolutional matrices. , Equal to the bias term; ⊙ represents a two-dimensional convolution operation, and ⊙ represents an element-wise multiplication operation. Step 3-3 Feature Fusion Output: After After processing by the ConvLSTM hidden layers, the hidden states of each layer are taken as the fusion result of multi-scale features. This feature strengthens the correlation between different feature combinations and network behavior, and improves the comprehensiveness and effectiveness of feature representation. Step 4: Input the output fusion features into the pre-constructed classification output network. The classification output network outputs the classification result through linear transformation and activation function to complete the intrusion detection. A fully connected layer is used as the classification output network. Through multi-layer linear transformation and activation functions, the final classification result is output to complete the vehicle network intrusion detection. The specific steps are as follows: Step 4-1 Parameter Definition: Fully connected layers include There are one hidden layer and one output layer; let the first one be... Hidden layers ( The number of nodes is The number of output layer nodes is The hidden layer activation function uses the ReLU function, and the output layer activation function uses the softmax function. Step 4-2 Hidden Layer Linear Transformation and Activation: The input to the first hidden layer is the fused feature output by ConvLSTM, and the input to subsequent hidden layers is the output of the previous hidden layer. The calculation formula for each hidden layer is: (6) in, , For the first The weight matrix of each hidden layer For the first The bias vectors of each hidden layer For the first The output of each hidden layer; Step 4-3 Output Layer Classification: The output layer receives the output of the last hidden layer, performs a linear transformation and softmax activation, and outputs the probability distribution of each category. The formula is as follows: (7) in, The weight matrix of the output layer. This is the bias vector for the output layer. For the prediction probability matrix, Indicates the first The sample belongs to the first The probability of a class; Step 4-4 Classification Result Determination: Take the category with the highest predicted probability as the final classification result for the sample, using the formula: (8) in, For the first The classification labels of each sample are used to complete intrusion detection.

[0024] The technical solution of this invention will be further elaborated below with specific simulation examples: This embodiment uses the NSL-KDD dataset as training and testing data. This dataset is an improved version of the KDD Cup 1999 dataset. It has no redundant records and balanced samples. Each data point contains 41 features, which are divided into basic features, content features, traffic-based features, and one label (normal or attack). The attack types are divided into four categories: DOS, R2L, U2R, and Probe.

[0025] 1. The specific preprocessing steps are as follows: (1) Encoding: Categorical features (such as protocol_type, service, flag) in the dataset are converted into numerical features using one-hot encoding. Protocol_type (TCP, UDP, ICMP) is converted into a 3-dimensional encoding vector, service (http, ftp, etc.) is converted into a 70-dimensional encoding vector, and flag is converted into an 11-dimensional encoding vector. Numerical features (such as duration, src_bytes, dst_bytes, etc.) remain unchanged. Finally, all features are converted into a unified numerical feature vector with a size of (122,1). (2) Normalization: The Min-Max normalization method is used to map all feature values ​​to the [0,1] interval to eliminate the difference in dimensions. The normalization formula is: x_norm=(x-x_min) / (x_max-x_min), where x is the original feature value, x_min is the minimum value of the feature, and x_max is the maximum value of the feature. (3) Zero padding transformation: The normalized feature vector is padded with 22 zeros and transformed into a two-dimensional feature matrix with a uniform size of (12,12) to adapt to the input requirements of the multi-scale dilated convolution module and ensure that all sample input sizes are consistent; 2. The specific steps for model training are as follows: (1) such as Figure 2 The diagram shown is a detailed structural diagram of the model, with parameter settings for each module: Multi-scale dilated convolution module: Three dilated convolution branches are set up with dilation rates d1=1, d2=3, and d3=5, respectively, which satisfies the requirement that there is no common divisor greater than 1 among the dilation rates to avoid grid effect; the kernel size of each branch is 3×3 and the number of output channels is 64. The ReLU activation function is used to alleviate the gradient vanishing problem.

[0026] The ConvLSTM module contains two hidden layers, each with a dimension h=128. The forget gate, input gate, and output gate all use the sigmoid activation function, while the cell state update uses the tanh activation function. The dropout rate is set to 0.5 to prevent the model from overfitting.

[0027] Fully connected layer: contains 2 hidden layers. The first hidden layer has 256 nodes, the second hidden layer has 128 nodes, and the output layer has 5 nodes (corresponding to normal connections and 4 types of attacks). The output layer uses the softmax activation function to output the probability distribution of each category.

[0028] (2) Training details: The Adam optimizer was used with a learning rate of 0.001 and a decay coefficient of 1e-5. The cross-entropy loss function was used to measure the difference between the model's prediction and the true label. The training batch size was set to 32, and the number of training iterations was set to 100. An early stopping strategy was adopted: when the validation set loss did not decrease for 10 consecutive iterations, training was stopped, the optimal model parameters were saved, and overfitting was avoided.

[0029] 3. Model Evaluation and Testing The preprocessed test set was input into the trained optimal model, and the test results are as follows: the overall accuracy of the model reached 98.5%, the precision reached 98.3%, the recall reached 98.1%, and the F1 score reached 98.2%. Among them, the detection accuracy for DOS attacks was 99.2%, and the accuracy for difficult-to-detect attacks such as R2L and U2R reached over 97.8%, proving that the present invention can effectively capture multi-scale features, improve the performance of vehicle network intrusion detection, and effectively defend against various network attacks.

[0030] Example 2: This embodiment provides a vehicle-to-everything (V2X) intrusion detection system based on multi-scale ConvLSTM, used to implement the V2X intrusion detection method based on multi-scale ConvLSTM described in Embodiment 1, including: The data preprocessing module is used to receive the vehicle network traffic table data and preprocess the table data to convert it into a two-dimensional feature matrix of uniform size. The table data includes source address, destination address, packet length, connection duration, protocol type, and number of error segments. The multi-scale feature extraction module is used to construct a multi-scale dilated convolutional network. The two-dimensional feature matrix is ​​input into the multi-scale dilated convolutional network to extract feature maps of multiple different scales and generate a multi-scale feature set. The multi-scale dilated convolutional network includes multiple dilated convolutional branches with different dilation rates, and the multiple dilated convolutional branches run in parallel to extract features of different scales. The ConvLSTM fusion module is used to build a lightweight feature fusion unit based on the ConvLSTM architecture. It takes the features of each scale in the multi-scale feature set as independent time steps and inputs them into the lightweight feature fusion unit. It performs spatiotemporal coding fusion through a gating mechanism of forget gate, input gate, and output gate to output fused features. The classification output module is used to input the fused features of the output into a pre-constructed classification output network. The classification output network outputs the classification result through linear transformation and activation function to complete the intrusion detection. The classification output network is constructed using a fully connected layer, which includes multiple hidden layers and an output layer.

[0031] Example 3: The present invention provides a terminal device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. The memory stores the computer program capable of running on the processor. When the processor loads and executes the computer program, it adopts the vehicle-to-everything (V2X) intrusion detection method based on multi-scale ConvLSTM described in Embodiment 1.

[0032] It should be noted that the terminal device can be a computer device such as a desktop computer, a laptop computer, or a cloud server, and the terminal device includes, but is not limited to, a processor and a memory. For example, the terminal device may also include input / output devices, network access devices, and buses.

[0033] Furthermore, the processor can be a central processing unit (CPU). Of course, depending on the actual use, other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. can also be used. The general-purpose processor can be a microprocessor or any conventional processor, etc., and this application does not limit it in this regard.

[0034] In the description of this specification, the references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0035] The foregoing has shown and described the basic principles, main features, and advantages of this application. Those skilled in the art should understand that this application is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of this application. Various changes and modifications can be made to this application without departing from the spirit and scope thereof, and all such changes and modifications fall within the scope of the claims of this application.

Claims

1. A vehicle-to-everything (V2X) intrusion detection method based on multi-scale ConvLSTM, characterized in that, Includes the following steps: Receive vehicle network traffic table data and preprocess the table data to convert it into a two-dimensional feature matrix of uniform size. The table data includes source address, destination address, packet length, connection duration, protocol type, and number of error segments. A multi-scale dilated convolutional network is constructed. A two-dimensional feature matrix is ​​input into the multi-scale dilated convolutional network to extract feature maps of multiple different scales and generate a multi-scale feature set. The multi-scale dilated convolutional network includes multiple dilated convolutional branches with different dilation rates, and the multiple dilated convolutional branches run in parallel to extract features of different scales. A lightweight feature fusion facilitator is constructed based on the ConvLSTM architecture. The features of each scale in the multi-scale feature set are input into the lightweight feature fusion facilitator as independent time steps. Spatiotemporal coding fusion is performed through a gating mechanism of forget gate, input gate, and output gate to output fused features. The fused features of the output are input into a pre-constructed classification output network. The classification output network outputs the classification result through linear transformation and activation function to complete the intrusion detection. The classification output network is constructed using a fully connected layer, which includes multiple hidden layers and an output layer.

2. The vehicle network intrusion detection method based on multi-scale ConvLSTM according to claim 1, characterized in that: Receive network traffic table data from the vehicle-to-everything (V2X) network and preprocess the table data to convert it into a two-dimensional feature matrix of uniform size, as follows: The categorical features in the table data are converted into numerical features using one-hot encoding, while the numerical features retain their original values, resulting in the encoded data. The encoded dataset is normalized using the Min-Max normalization method, mapping all feature values ​​to the [0,1] interval to obtain the normalized data; The eigenvectors in the normalized data are padded with zeros to convert them into a two-dimensional feature matrix of uniform size, and the two-dimensional feature matrix is ​​output.

3. The vehicle network intrusion detection method based on multi-scale ConvLSTM according to claim 2, characterized in that: The one-hot encoding satisfies the following conditions: Suppose a certain type of feature has The first of the different categories, this feature The value of the nth sample is the nth kind, Then its one-hot encoding result satisfy: in, Dimension index of the encoded vector ( Numerical features retain their original values, and after encoding, a unified numerical dataset is obtained. , This represents the total dimension of the encoded features.

4. The vehicle network intrusion detection method based on multi-scale ConvLSTM according to claim 2, characterized in that: The encoded data is normalized using the Min-Max normalization method, as follows: For the encoded dataset The first in Features , its first Normalization results for each sample The calculation formula is: in, For the encoded number The sample, the first The values ​​of each feature, , The first The minimum and maximum values ​​of each feature are normalized to obtain the data. .

5. The vehicle network intrusion detection method based on multi-scale ConvLSTM according to claim 2, characterized in that: The eigenvectors in the normalized data are padded with zeros to convert them into two-dimensional feature matrices of uniform size, as follows: Let the target input size be If the dimension of the normalized single-sample feature vector is The zero-padding operation is represented as: in, For feature height, For feature width, For the normalized first The feature vector of each sample This is a zero-padding function; after zero-padding, the single-sample two-dimensional feature matrix... After padding all samples with zeros, the resulting two-dimensional feature matrix is ​​represented as follows: .

6. The vehicular network intrusion detection method based on multi-scale ConvLSTM according to claim 5, characterized in that: A multi-scale dilated convolutional network is constructed. A two-dimensional feature matrix is ​​input into the multi-scale dilated convolutional network to extract feature maps of multiple different scales, generating a multi-scale feature set, as detailed below: Parameter definition: The void ratios of each branch are respectively ,satisfy Furthermore, there is no common divisor greater than 1 between any two void rates; Each branch uses a convolution kernel of the same size. , The convolution kernel side length is , and the number of convolution kernels is . The activation function used is the ReLU function; Dilated convolution operation: For the first One branch, Corresponding to void ratio Its convolution operation formula is: in, Indicates the void ratio dilated convolution operation, For the first Bias vectors of each branch For the first Feature maps output by each branch; Multi-scale feature set acquisition: After T branches perform dilated convolution operations in parallel, they output T feature maps of different scales, which are then integrated to form a multi-scale feature set. .

7. The vehicle network intrusion detection method based on multi-scale ConvLSTM according to claim 1, characterized in that: A lightweight feature fusion builder is constructed based on the ConvLSTM architecture. Features at each scale in the multi-scale feature set are input into the lightweight feature fusion builder as independent time steps. Spatiotemporal encoding fusion is performed through a gating mechanism of forget gate, input gate, and output gate to output fused features, as detailed below: Parameter definition: The lightweight feature fusion unit includes Hidden layers, each with a dimension of [missing information]. ; Let the input be a multi-scale feature set. After dimensional adjustment ,in To simulate timing step size, and The number of scales is consistent, and each simulation time step corresponds to A unique feature at different scales. The feature dimension for each simulation time step; Hidden state is , For hidden layer index, Cell state is ; Multi-scale feature fusion is achieved through the synergistic effect of the forget gate, input gate, and output gate. The computation process is as follows: in, , , These are the input gate, forget gate, and output gate, respectively, and the feature flow is controlled by the Sigmoid activation function. Candidate cell state, In cellular state, Output features for the current time step; The multi-scale fusion feature input is given at time step t, where t = 1, 2, ..., T; , It is a 3×3 convolution weight matrix. , Equal to the bias term; ⊙ represents a two-dimensional convolution operation, and ⊙ represents an element-wise multiplication operation. Fusion feature output: after After processing the hidden layers of ConvLSTM, the hidden states of each layer are taken as the fused features of multi-scale features. .

8. The vehicle network intrusion detection method based on multi-scale ConvLSTM according to claim 7, characterized in that: The fused output features are input into a pre-constructed classification output network, which then outputs the classification result through linear transformation and activation function, as follows: Fully connected layers include There are one hidden layer and one output layer. Let the first hidden layer be the first output layer. A hidden layer, The number of nodes is The number of output layer nodes is The hidden layer activation function uses the ReLU function, and the output layer activation function uses the softmax function. Linear transformation and activation of hidden layers: The input to the first hidden layer is the fused feature output by ConvLSTM, and the input to subsequent hidden layers is the output of the previous hidden layer. The calculation formula for each hidden layer is: in, , For the first The weight matrix of each hidden layer For the first The bias vectors of each hidden layer For the first The output of each hidden layer; Output layer classification: The output layer receives the output of the last hidden layer, performs a linear transformation and softmax activation, and outputs the probability distribution of each category. The formula is as follows: in, The weight matrix of the output layer. This is the bias vector for the output layer. For the prediction probability matrix, Indicates the first The sample belongs to the first The probability of a class; Classification result determination: The category with the highest predicted probability is taken as the final classification result for the sample, using the following formula: in, For the first The classification labels of each sample are used to complete intrusion detection.

9. A vehicle-to-everything (V2X) intrusion detection system based on multi-scale ConvLSTM, used to implement the V2X intrusion detection method based on multi-scale ConvLSTM as described in any one of claims 1 to 8, characterized in that, include: The data preprocessing module is used to receive the vehicle network traffic table data and preprocess the table data to convert it into a two-dimensional feature matrix of uniform size. The table data includes source address, destination address, packet length, connection duration, protocol type, and number of error segments. The multi-scale feature extraction module is used to construct a multi-scale dilated convolutional network. The two-dimensional feature matrix is ​​input into the multi-scale dilated convolutional network to extract feature maps of multiple different scales and generate a multi-scale feature set. The multi-scale dilated convolutional network includes multiple dilated convolutional branches with different dilation rates, and the multiple dilated convolutional branches run in parallel to extract features of different scales. The ConvLSTM fusion module is used to build a lightweight feature fusion unit based on the ConvLSTM architecture. It takes the features of each scale in the multi-scale feature set as independent time steps and inputs them into the lightweight feature fusion unit. It performs spatiotemporal coding fusion through a gating mechanism of forget gate, input gate, and output gate to output fused features. The classification output module is used to input the fused features of the output into a pre-constructed classification output network. The classification output network outputs the classification result through linear transformation and activation function to complete the intrusion detection. The classification output network is constructed using a fully connected layer, which includes multiple hidden layers and an output layer.

10. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that, When the processor loads and executes the computer program, it employs the vehicle network intrusion detection method based on multi-scale ConvLSTM as described in any one of claims 1 to 8.

Images