An intelligent connected vehicle anomaly detection method and system based on latent distribution difference feature fusion

Abstract

The application belongs to the technical field of Internet of Vehicles, and discloses an intelligent networked vehicle anomaly detection method and system based on latent distribution difference feature fusion, which comprises the following steps: S1, data acquisition and preprocessing; S2, data feature expansion and input vector construction; S3, VAE model construction and training; S4, extraction of latent variable distribution features, wherein the latent variable distribution features comprise a VAE latent variable vector, a KL divergence feature and a reconstruction error feature; S5, latent variable difference feature enhancement fusion, wherein difference features are constructed according to the reconstruction error and the KL divergence, multi-dimensional fusion is performed, and a fusion feature vector is obtained; S6, construction of an ELM classifier; S7, optimization of the parameters of the ELM classifier by using SSA; S8, intrusion detection by using the optimized model, and output of the result. The application comprehensively captures the difference between normal messages and abnormal messages, effectively improves the robustness of anomaly identification, and realizes accurate identification of abnormal attacks.

Description

Technical Field

[0001] This invention belongs to the field of vehicle networking technology, specifically relating to an anomaly detection method and system for intelligent connected vehicles based on the fusion of potential distribution difference features. Background Technology

[0002] Currently, with the development of intelligent connected vehicles, technologies related to vehicle network access, such as the Controller Area Network (CAN) and vehicle communication systems, face increasing risks of network attacks. Intelligent connected vehicle CAN bus communication is characterized by low data dimensionality, complex communication modes, and covert attack types. Existing deep learning intrusion detection methods often employ variational autoencoders (VAEs) for feature extraction, but they only use latent variable vectors, reconstruction errors, or KL divergences as discrimination criteria, failing to jointly model reconstruction bias, potential distribution shifts, and distribution differences. This directly leads to the model's inability to simultaneously characterize the reconstruction bias and potential distribution shifts of samples, failing to fully capture the essential differences between normal and anomalous attack messages, resulting in insufficient robustness in anomaly identification and a tendency for false positives and false negatives. Furthermore, due to their insufficient ability to capture the essential differences in anomalous messages, these methods typically rely on expert experience to define rules, making it difficult to cover unknown attack patterns, and their feature engineering is cumbersome with limited generalization capabilities. Furthermore, existing technologies, such as VAE-based detection methods, only use latent variables as classification inputs. As a result, there is a significant overlap between normal and abnormal samples in the latent space. Moreover, existing methods do not design nonlinear features to amplify abnormal residuals, which leads to poor linear separability of abnormal samples in the low-dimensional feature space and a high false negative rate for anomaly identification, thus failing to meet the requirements of vehicle safety detection. Summary of the Invention

[0003] The purpose of this invention is to provide an anomaly detection method for intelligent connected vehicles based on the fusion of latent distribution difference features, so as to solve the technical problem that existing technologies are unable to simultaneously characterize the reconstruction bias and latent distribution shift of samples, and the linear separability of abnormal samples is poor, resulting in a high probability of misjudgment and missed judgment.

[0004] The intelligent connected vehicle anomaly detection method based on latent distribution difference feature fusion includes the following steps: S1. Data acquisition and preprocessing; S2, Data Feature Expansion and Input Vector Construction; S3. Construct and train the VAE model; S4. Extract the latent variable distribution features, which include the VAE latent variable vector, KL divergence features, and reconstruction error features; S5. Enhanced fusion of latent variable difference features: The structural patterns of samples are statistically analyzed through the distribution of latent space samples. Then, difference features are constructed based on reconstruction error and KL divergence. The VAE latent variable vector, reconstruction error features, KL divergence features and difference features are fused in multiple dimensions to obtain the fused feature vector. S6. Construct an ELM classifier; The ELM classifier receives the fused feature vector, processes it, and outputs the classification result. S7. Optimize the parameters of the ELM classifier using SSA; S8. Use the optimized model for intrusion detection and output the results.

[0005] Preferably, step S5 includes: S5.1 Analysis of the latent space sample distribution pattern; obtaining the inverse characteristics of normal and abnormal samples in terms of reconstruction error and KL divergence; S5.2 Constructing Differential Features: Construct differential features using the aforementioned inverse properties, expressed as follows: ,in, This represents the difference feature corresponding to the i-th input vector. This represents the reconstruction error feature corresponding to the i-th input vector. This represents the KL divergence feature corresponding to the i-th input vector. It is a set value used to prevent the denominator from being 0 in the special case where the KL divergence is 0; S5.3 Multi-spatial feature fusion: splice the VAE latent variable vector, reconstruct error features, KL divergence features and difference features to form a fused feature vector.

[0006] Preferably, in step S5.1, the latent space sample distribution pattern includes: clusters have been formed in the VAE latent variable space sample distribution, but the sample boundaries still overlap; the opposite characteristics are: normal samples: small reconstruction error, large KL divergence; abnormal samples: large reconstruction error, small KL divergence.

[0007] Preferably, step S3 specifically includes: S3.1 Construct a VAE model, which includes an input layer, an encoding layer, and a decoding layer; S3.2 Determine the model's loss function. The model loss function is: ,in For model loss, To reconstruct the loss, For KL divergence loss, These are the weighting coefficients for the KL divergence loss; S3.3 Train the constructed VAE model to obtain the trained VAE model.

[0008] Preferably, in step S3.2, the reconstruction loss function is: ,in, Let BCE represent the original input sample and the reconstructed output sample, respectively, and let E[ [] represents the expectation operation; the KL divergence loss function is:

[0009] Where the subscript j represents the latent variable dimension index, Let the variance of the j-th latent variable be denoted as . Let represent the mean of the j-th latent variable, where n is the dimension of the latent variable.

[0010] Preferably, in step S4, the latent variable distribution features are extracted from the input vector using the trained VAE model. These latent variable distribution features include: VAE latent variable vector: , This represents the i-th input vector (i.e., sample). This represents the i-th VAE latent variable vector corresponding to the i-th input vector. This indicates the process of finding the mean vector; KL divergence characteristics:

[0011] in, This represents the KL divergence feature corresponding to the i-th input vector. Let the variance of the j-th latent variable in the i-th input vector be denoted as . Let represent the mean of the j-th latent variable of the i-th input vector, where n is the dimension of the latent variable; Reconstruction error characteristics:

[0012] in, This represents the reconstruction error feature corresponding to the i-th input vector. This represents the k-th dimension of the original feature value of the i-th input vector. Let m represent the k-th dimension reconstructed feature value of the i-th input vector, where m is the dimension of the input vector.

[0013] Preferably, in step S6, the formula for calculating the output weights of the ELM classifier is: Where H is the hidden layer output matrix; T is the label matrix; is the generalized inverse matrix; SSA is used to optimize the number of hidden layer nodes and regularization coefficients of the ELM classifier; in step S7, the parameters of SSA include population size, maximum number of iterations, discoverer ratio and vigilant ratio. After setting the above SSA parameters, the optimal ELM parameters are obtained through iterative search.

[0014] Preferably, step S1 specifically includes: S1.1 Collect communication data of the intelligent connected vehicle, wherein the communication data includes message ID, data field, attack type identifier and anomaly label; S1.2. Preprocess the communication data, including numericalizing and normalizing the original data.

[0015] Preferably, step S2 specifically includes: S2.1 Extract feature fields from the communication data and perform feature enhancement processing. The enhanced features include data byte features, message ID binary bit features, and statistical features. S2.2. Concatenate the features extracted and enhanced in step S2.1 to form an input vector.

[0016] This invention also provides an intelligent connected vehicle anomaly detection system based on latent distribution difference feature fusion, comprising: Data acquisition and preprocessing module: used to acquire communication data from the CAN bus of intelligent connected vehicles and preprocess the communication data; Data feature expansion and input vector construction module: used to extract and enhance feature fields from preprocessed communication data and construct input vectors; Latent variable feature extraction module: This module has a built-in trained VAE model, which is used to extract the distribution features of latent variables; The latent variable difference feature enhancement and fusion module is used to construct difference features based on the reconstruction error REC and KL divergence, and then perform multi-dimensional fusion to obtain a fused feature vector. Intelligent Decision Module: This module uses the optimized ELM model to make intelligent decisions and determine whether the corresponding sample is an anomalous sample; Alarm output module: When the classification result is abnormal, an alarm signal is output.

[0017] The technical advantages of this invention are as follows: This invention targets unbalanced CAN bus data samples in intrusion detection. By statistically analyzing the structural patterns of the data through latent space sample distribution, it proposes a latent variable divergence difference enhancement mechanism. Specifically, this invention fully utilizes the latent statistical characteristics of VAEs, and for the first time constructs an enhancement vector from the latent variable distribution KL divergence, reconstruction error, and the difference between their distributions. This improves the detection performance of unbalanced scenarios without introducing class weights. Furthermore, it fuses the latent variable vector, KL divergence features, reconstruction error features, and newly constructed difference features in multiple dimensions, thereby constructing a three-space (latent space, reconstruction space, and structural difference space) coupled feature expression model.

[0018] Through the aforementioned technological innovations, this invention designs a nonlinear feature amplification anomaly residuals, enabling anomaly samples in the low-dimensional feature space to exhibit high linear separability and high anomaly identification accuracy. Simultaneously, through a three-space coupled feature representation model, this invention can simultaneously characterize the reconstruction bias and potential distribution shift of samples, comprehensively capturing the differences between normal and anomaly messages, effectively improving the robustness of anomaly identification. Furthermore, the method itself can accurately identify anomalous attacks by characterizing the reconstruction bias and potential distribution shift of samples. Therefore, this invention does not rely on expert experience to define rules, can cover unknown attack patterns, and has strong generalization ability.

[0019] Furthermore, this invention introduces the Sparrow Search Algorithm (SSA) to optimize the ELM (Extreme Learning Machine) parameters, including the number of neurons in the ELM hidden layer and the regularization coefficient C. This enables the construction of a lightweight, high-precision intrusion detection system, improving stability and generalization ability. By integrating multiple innovations such as structural enhancement, swarm intelligence optimization, and a lightweight classifier, the ELM classifier of this invention aims to improve the F1 score, reducing the false positive and false negative rates in intrusion detection while ensuring accuracy. The classifier has a simple structure and is computationally efficient, allowing it to be embedded in vehicle gateway systems for real-time monitoring. Attached Figure Description

[0020] Figure 1 This is a flowchart of an anomaly detection method for intelligent connected vehicles based on the fusion of latent distribution difference features according to the present invention; Figure 2 This is a flowchart of the system detection process of the present invention; Figure 3 This is a flowchart illustrating the enhanced fusion of latent variable distribution features and latent variable difference features extracted in this invention. Figure 4 This is a flowchart illustrating the optimization of the Extreme Learning Machine (ELM) using the Sparrow Search Algorithm (SSA) in this invention. Figure 5 This is a two-dimensional projection diagram of the potential space in this invention; Figure 6This is a diagram showing the reconstruction error distribution of the present invention; Figure 7 This is the KL divergence distribution diagram of the present invention. Detailed Implementation

[0021] The following detailed description of the embodiments, with reference to the accompanying drawings, will further illustrate the specific implementation of the present invention, in order to help those skilled in the art to have a more complete, accurate, and in-depth understanding of the inventive concept and technical solution of the present invention.

[0022] With the development of intelligent connected vehicles, the Controller Area Network (CAN) and vehicle communication systems face increasing network attack risks, such as message forgery attacks, denial-of-service attacks, and replay attacks. In intelligent connected vehicle scenarios, communication data suffers from low dimensionality but complex patterns, a low proportion of attack samples, and severe class imbalance, posing challenges to the learning and detection capabilities of deep learning models in intrusion detection.

[0023] The existing anomaly detection models and methods also have the following technical problems: (1) They rely on traditional rule-based detection models and machine learning classification methods, and it is difficult to balance various identification indicators. Such methods usually rely on expert experience to define rules, which is difficult to cover unknown attack patterns. Moreover, feature engineering is cumbersome and the generalization ability is limited. (2) For unbalanced intrusion detection samples, class weights or data augmentation are used. For example, linear interpolation samples generated by SMOTE may destroy the physical semantics of CAN bus data, causing the model to learn false features, distorting the model's cognition of the real data distribution, and causing the training process to be unstable. (3) Existing deep learning model intrusion detection methods are difficult to simultaneously characterize the reconstruction bias and potential distribution shift of samples, resulting in insufficient robustness of anomaly identification. (4) Existing methods fail to effectively balance the real-time performance and generalization robustness of detection, resulting in either excessive detection latency or insufficient identification ability for new attacks in environments with limited onboard computing power.

[0024] Therefore, it is necessary to improve and innovate existing technologies to explore the deep latent variable distribution of samples and fundamentally improve the model's ability to adapt to imbalanced data. At the same time, by combining the extreme learning machine optimized by the sparrow search algorithm, the generalization performance against unknown attacks can be significantly enhanced while ensuring inference speed. This will comprehensively solve the key problems in existing technologies, such as imbalanced identification indicators, unstable training, poor robustness, and the difficulty in balancing real-time performance and generalization.

[0025] like Figures 1-7 As shown, this invention provides an anomaly detection method for intelligent connected vehicles based on the fusion of latent distribution difference features, comprising the following steps: S1. Data Acquisition and Preprocessing.

[0026] This step involves acquiring communication data from the CAN bus of the intelligent connected vehicle and preprocessing the data. Specifically, it includes the following sub-steps: S1.1 Collect communication data from the intelligent connected vehicle. The communication data includes: (1) Message ID; (2) 8-byte data field; (3) Attack type identifier; (4) Abnormal labels.

[0027] S1.2. Preprocess the communication data. Preprocessing includes numerical and normalization of the raw data.

[0028] S2, Data Feature Expansion and Input Vector Construction.

[0029] This step extracts and enhances feature fields from the preprocessed communication data originating from the CAN bus of the intelligent connected vehicle, and constructs an input vector. Specifically, it includes the following sub-steps: S2.1 Extract feature fields from the communication data and perform feature enhancement processing. The enhanced features include: (1) Data byte characteristics (8 dimensions): Directly take 8 data bytes DATA_0~DATA_7 of the CAN message.

[0030] (2) Message ID binary bit features (11-dimensional): The 11-bit CAN ID data is expanded into binary to obtain 11 0 / 1 feature bits.

[0031] (3) Statistical characteristics (4 dimensions): The following calculations are performed on the data byte characteristics (8 data bytes): mean, standard deviation, maximum value, minimum value, a total of 4 statistical measures.

[0032] After the above feature enhancements, the binary expansion of the CAN ID data retains the arbitration domain structure information of the CAN ID, while the statistical features characterize the distribution characteristics of the data load. The combination of the two effectively enhances the VAE's ability to model normal / abnormal modes.

[0033] S2.2. Concatenate the features extracted and enhanced in step S2.1 to form an input vector. The dimension of the input vector is the sum of the dimensions of the data byte features, the message ID binary bit features, and the statistical features, i.e., 8 + 11 + 4 = 23 dimensions.

[0034] After obtaining the set of input vectors, it is divided into a training set, a validation set, and a test set, which are independent of each other.

[0035] S3. Construct and train the VAE model.

[0036] This step involves constructing a VAE model, determining the appropriate loss function, and training the VAE model to obtain a usable VAE model. Specifically, it includes the following sub-steps: S3.1 Construct the VAE model. The VAE model includes: (1) Input layer (23-dimensional); (2) Encoding layer (outputs 8-dimensional latent variables); (3) Decoding layer.

[0037] S3.2 Determine the loss function of the model.

[0038] The model loss function is: ,in For model loss, To reconstruct the loss, For KL divergence loss, These are the weighting coefficients for the KL divergence loss.

[0039] The reconstruction loss function is: ,in, Let BCE represent the original input sample and the reconstructed output sample, respectively, and let E[ ] indicates the expected operation.

[0040] The KL divergence loss function is:

[0041] Where the subscript j represents the latent variable dimension index, Let the variance of the j-th latent variable be denoted as . Let represent the mean of the j-th latent variable.

[0042] S3.3. Using the training set as input, train the constructed VAE model, minimize the model loss, and obtain the trained VAE model.

[0043] S4. Extract the distribution characteristics of latent variables.

[0044] This step extracts latent variable distribution features from the input vector using the trained VAE model. The latent variable distribution features include: (1) VAE latent variable vector (8 dimensions): , This represents the i-th input vector (i.e., sample). This represents the i-th VAE latent variable vector corresponding to the i-th input vector. This indicates the calculation of the mean vector. The physical meaning of the VAE latent variable vector expression is: the encoder maps the input vector to Gaussian distribution parameters in the latent space, and the mean vector in the Gaussian distribution parameters is the deterministic latent representation of the input vector, i.e., the VAE latent variable vector.

[0045] (2) KL divergence characteristics (1-dimensional):

[0046] in, This represents the KL divergence feature corresponding to the i-th input vector. Let the variance of the j-th latent variable in the i-th input vector be denoted as . Let represent the mean of the j-th latent variable in the i-th input vector. The physical meaning of the KL divergence feature expression is: to measure the degree of deviation of the latent distribution of the sample from the standard normal prior.

[0047] (3) Reconstruction error characteristics (1-dimensional):

[0048] in, This represents the reconstruction error feature corresponding to the i-th input vector. This represents the k-th dimension of the original feature value of the i-th input vector. Let represent the k-th dimension of the reconstructed feature value of the i-th input vector. The physical meaning of the reconstruction error feature expression is: to measure the quality of the VAE model's reconstruction of the sample (input vector).

[0049] S5, Enhanced Fusion of Latent Variable Difference Features.

[0050] like Figure 3 As shown, in intrusion detection, the data distribution is extremely uneven, with diverse information in normal samples and relatively homogeneous abnormal data among different types. To improve the linear separability of abnormal samples, this step statistically analyzes the structural patterns of the samples through latent space sample distribution. Then, based on the reconstruction error REC and KL divergence, differential features are constructed. The VAE latent variable vector, reconstruction error features, KL divergence features, and differential features are fused in multiple dimensions to obtain a fused feature vector. Thus, this step achieves a coupled and enhanced expression of the three spaces: latent space (i.e., latent variable space), reconstruction space (corresponding to REC and KL divergence), and structural differential space (corresponding to differential features).

[0051] This step specifically includes the following sub-steps: S5.1 Analysis of the distribution pattern of latent space samples: such as Figure 5 As shown, clusters have formed in the VAE latent variable space sample distribution, but the sample boundaries still overlap, making it difficult to make decisions about some anomalous samples. This sample distribution pattern is consistent with the characteristics of anomalous samples disguising attacks in intrusion detection, and it is also the reason why the recall rate is only 0.866 when only the VAE latent variable vector Z is input into the classifier.

[0052] Having identified the above characteristics, we further explore the inverse relationship between normal and abnormal samples in terms of reconstruction error and KL divergence. Specifically, this includes: (1) Analyze the distribution of reconstruction error values: such as Figure 6 As shown, normal samples are extremely concentrated between 0.00 and 0.01, while abnormal samples are mainly distributed between 0.02 and 0.08, with no overlap between 0.01 and 0.02. The comparison reveals a large reconstruction error, which is caused by the extreme imbalance of the data. The model learns better from normal samples with a large amount of data.

[0053] (2) KL divergence distribution: such as Figure 7 As shown, normal samples are distributed between 2.8 and 3.0, with a relatively dispersed distribution, while abnormal samples are distributed between 2.8 and 3.2, with a relatively concentrated distribution. This is consistent with the diverse characteristics of normal samples and the relatively uniformity of abnormal samples.

[0054] By combining the reconstruction error and KL divergence of normal and abnormal samples, we found that: normal samples have small reconstruction error and large KL divergence, while abnormal samples have large reconstruction error and small KL divergence, showing opposite characteristics.

[0055] S5.2 Constructing Differential Features: Using the inverse properties of normal and abnormal samples in reconstruction error and KL divergence determined in the previous step, differential features are constructed to amplify and enhance the degree of abnormality.

[0056] The expression for constructing the 1-dimensional differential feature R is: ,in, This represents the difference feature corresponding to the i-th input vector. This represents the reconstruction error feature corresponding to the i-th input vector. This represents the KL divergence feature corresponding to the i-th input vector. This is a setting value used to prevent the denominator from being 0 in the special case where the KL divergence is 0, and it does not affect the proportional calculation.

[0057] The physical meaning of the difference feature R expression: Normal messages, due to carrying complex vehicle dynamic semantics, have a probability distribution that deviates from the standard normal prior, exhibiting large KL divergence. Furthermore, because they conform to the protocol manifold learned by the model, their reconstruction accuracy is high. Conversely, anomalously injected messages typically have a single pattern and high repetition, resulting in extremely small KL divergence. Moreover, because they violate normal protocol logic, they cannot be accurately reconstructed. Feature R quantizes and concatenates the differences between these two indicators through nonlinear combination, amplifying the anomalous residuals through division operations, thereby constructing extremely high linear separability in a low-dimensional feature space.

[0058] S5.3 Multi-spatial Feature Fusion: Concatenate the VAE latent variable vector Z, reconstruction error feature REC, KL divergence feature KL, and difference feature R to form a fused feature vector F, i.e., F = [Z, REC, KL, R], where Z = [z1, z2, ..., z n In this embodiment, the dimension n=8 of the VAE latent variable vector Z, ultimately forming an 11-dimensional fused feature vector F. The performance data comparison results of different feature fusions are shown in Table 1. Table 1 Performance Comparison of Feature Fusion

[0059] S6. Construct an Extreme Learning Machine (ELM) classifier.

[0060] This step constructs the ELM classifier. The formula for calculating the output weights of the ELM classifier is as follows: Where H is the hidden layer output matrix; T is the label matrix; is the generalized inverse matrix. The ELM classifier receives the fused feature vector F and inputs it into the ELM hidden layer. After processing, it outputs the classification result and determines whether the corresponding sample is an anomalous sample.

[0061] S7. Use the Sparrow Search Algorithm (SSA) to optimize the parameters of the Extreme Learning Machine (ELM) classifier.

[0062] like Figure 4 As shown, this step uses the Sparrow Search Algorithm (SSA) to optimize the following ELM parameters: number of hidden layer nodes and regularization coefficient C; the input weight is set to 1 by default in this invention.

[0063] This step applies a fitness function to optimize the F1 score on the validation set, aiming to reduce the false negative and false positive rates. Optimal ELM parameters are obtained through iterative search, considering the number of hidden layer nodes and the regularization coefficient.

[0064] The parameters of the Sparrow Search Algorithm (SSA) include population size, maximum number of iterations, finder ratio, and watcher ratio. After setting these SSA parameters, the optimal ELM parameters are obtained through iterative search. The SSA parameters can be preferably: Population size: 30; Maximum number of iterations: 50; Discoverer percentage: 20%; Percentage of vigilant individuals: 10%.

[0065] The above SSA parameters are preferred embodiments. Those skilled in the art can adjust them according to the actual data scale and computing power constraints. For example, the population size can be set to 20-50 and the number of iterations can be set to 30-100.

[0066] S8. Use the optimized model for intrusion detection and output the results.

[0067] like Figure 2 As shown, the optimized model is used for intrusion detection. The process includes: inputting test samples, performing VAE feature extraction, constructing feature vector F, ELM classification, and outputting detection results.

[0068] Based on the above method, the present invention also provides an intelligent connected vehicle anomaly detection system based on latent distribution difference feature fusion, comprising the following modules: Data acquisition and preprocessing module: Used to acquire communication data from the CAN bus of intelligent connected vehicles and preprocess the communication data.

[0069] This module, deployed on the vehicle gateway or core ECU, is responsible for monitoring CAN bus traffic and collecting real-time communication data from intelligent connected vehicles, including message IDs, 8-byte data fields, timestamp information, etc. The data originates from the vehicle's CAN bus. This module also performs numerical and normalization processing on the raw data.

[0070] Data Feature Extension and Input Vector Construction Module: Used to extract and enhance feature fields from preprocessed communication data and construct input vectors.

[0071] The workflow of this module includes: expanding the 11-bit CAN ID into binary to obtain 11 0 / 1 feature bits (message ID binary bit features), preserving the ID's structural information; splitting the 8-byte data into 8 numerical features (data byte features); performing feature calculations on the data using four statistical measures (statistical features); and concatenating the above features to construct a 23-dimensional input vector.

[0072] Latent variable feature extraction module: This module has a built-in trained VAE model for extracting latent variable distribution features.

[0073] This module has a built-in trained variational VAE autoencoder model. During detection, the module receives a 23-dimensional input vector, processes it through the variational VAE autoencoder, outputs an 8-dimensional VAE latent variable vector, and calculates the reconstruction error features and KL divergence features.

[0074] The latent variable differential feature enhancement and fusion module is used to construct differential features based on the reconstruction error REC and KL divergence, and then perform multi-dimensional fusion to obtain a fused feature vector. The final fused feature vector is: F=[Z,REC,KL,R]. This module realizes three-space coupling enhanced expression.

[0075] Intelligent Decision Module: This module uses the optimized ELM model to make intelligent decisions and determine whether the corresponding sample is an anomalous sample.

[0076] This module has a built-in trained ELM classifier. After receiving the fused feature vector F, it inputs it into the hidden layer of the ELM, processes it, and outputs the classification result to determine whether the corresponding sample is an abnormal sample.

[0077] Alarm output module: When the classification result is abnormal, it outputs an alarm signal, records an anomaly log, and triggers a security protection strategy. Recording anomaly logs and triggering security protection strategies are optional functions of this module.

[0078] The above-mentioned intelligent connected vehicle anomaly detection system based on the fusion of potential distribution difference features adopts a modular design. Each module communicates with each other through a standard API interface. It can be flexibly deployed on different hardware platforms according to actual computing power requirements, such as: (1) vehicle gateway device; (2) edge computing unit; (3) cloud security platform.

[0079] Experiments were conducted to verify the effectiveness of the solution provided by this invention, and the following advantages of this invention compared to the prior art were found: (1) Significantly improve detection accuracy The experiment used the CICIOV2024 dataset. The results showed: Accuracy: 0.998; Recall: 0.999; Precision: 0.989; F1 score: 0.994. However, using only Z as the ELM classification resulted in: Accuracy: 0.979; Recall: 0.866; Precision: 0.977; F1 score: 0.918. The comparison revealed improvements in all metrics, with a significant increase in recall, indicating an extremely low false negative rate, which is crucial for intrusion detection systems.

[0080] (2) Enhance structural discrimination ability Simultaneously, it characterizes data reconstruction bias, latent distribution shift, and the differences between their distributions, enhancing the model's ability to distinguish complex attack samples; at the same time, it forms a three-layer spatially coupled expression model by splicing together four features: latent variables, reconstruction error, KL divergence, and difference features, thereby improving the separation of abnormal samples.

[0081] (3) Enhance generalization ability Improved Generalization Ability: The Sparrow Search Algorithm (SSA) is employed with the validation set F1 score as the optimization objective, globally searching for the optimal number of hidden layer nodes and the regularization coefficient C in the ELM model. This strategy fundamentally eliminates the impact of random initialization on model performance, making the decision boundary more stable and thus improving the model's generalization ability. Experiments show that on a noise-free test set, the SSA-optimized model achieves an F1 score of 0.994, significantly outperforming the unoptimized model.

[0082] (4) Enhance noise resistance Enhanced Noise Robustness: By fusing reconstructed features into the input ELM features, the model can simultaneously characterize both the reconstruction bias and the underlying distribution shift of the samples. This multi-spatial feature coupling mechanism exhibits stronger tolerance to data noise. As shown in Table 2, at different noise levels, the F1 score of the model with fused reconstructed features is significantly higher than that without them. Furthermore, as the noise intensity increases (e.g., 20% heavy noise), the performance gap further widens to +0.141, fully demonstrating the crucial role of differential feature fusion in improving model robustness.

[0083] Table 2. F1 scores of ELM classification for different input features under different noise levels.

[0084] (5) Applicable to real-time detection The final input feature dimension of this invention is only 11 dimensions, and the ELM classifier only needs a single matrix operation to complete the inference. The feature dimension is low; the ELM has low computational complexity; and it can meet the real-time detection and classification requirements of vehicles.

[0085] (6) It has good cross-domain transferability. This invention does not rely on a specific communication protocol and can be easily extended to the field of industrial Internet of Things, enabling real-time detection of network attacks on industrial control systems and abnormal monitoring of equipment operating status, further expanding the application scope and industrial value of the technology.

[0086] The present invention has been described above by way of example with reference to the accompanying drawings. Obviously, the specific implementation of the present invention is not limited to the above-described manner. Any non-substantial improvements made using the inventive concept and technical solution of the present invention, or the direct application of the inventive concept and technical solution of the present invention to other occasions without modification, are all within the protection scope of the present invention.

Claims

1. An anomaly detection method for intelligent connected vehicles based on latent distribution difference feature fusion, characterized in that, Includes the following steps: S1. Data acquisition and preprocessing; S2, Data Feature Expansion and Input Vector Construction; S3. Construct and train the VAE model; S4. Extract the latent variable distribution features, which include the VAE latent variable vector, KL divergence features, and reconstruction error features; S5. Enhanced fusion of latent variable difference features: The structural patterns of samples are statistically analyzed through the distribution of latent space samples. Then, difference features are constructed based on reconstruction error and KL divergence. The VAE latent variable vector, reconstruction error features, KL divergence features and difference features are fused in multiple dimensions to obtain the fused feature vector. S6. Construct an ELM classifier; The ELM classifier receives the fused feature vector, processes it, and outputs the classification result. S7. Optimize the parameters of the ELM classifier using SSA; S8. Use the optimized model for intrusion detection and output the results.

2. The intelligent connected vehicle anomaly detection method based on latent distribution difference feature fusion according to claim 1, characterized in that, Step S5 includes: S5.1 Analysis of the latent space sample distribution pattern; obtaining the inverse characteristics of normal and abnormal samples in terms of reconstruction error and KL divergence; S5.2 Constructing Differential Features: Construct differential features using the aforementioned inverse properties, expressed as follows: ,in, This represents the difference feature corresponding to the i-th input vector. This represents the reconstruction error feature corresponding to the i-th input vector. This represents the KL divergence feature corresponding to the i-th input vector. It is a set value used to prevent the denominator from being 0 in the special case where the KL divergence is 0; S5.3 Multi-spatial feature fusion: splice the VAE latent variable vector, reconstruct error features, KL divergence features and difference features to form a fused feature vector.

3. The intelligent connected vehicle anomaly detection method based on latent distribution difference feature fusion according to claim 2, characterized in that, In step S5.1, the latent space sample distribution pattern includes: clusters have been formed in the VAE latent variable space sample distribution, but the sample boundaries still overlap; the opposite characteristics are: normal samples: small reconstruction error, large KL divergence; abnormal samples: large reconstruction error, small KL divergence.

4. The intelligent connected vehicle anomaly detection method based on latent distribution difference feature fusion according to claim 1, characterized in that, Step S3 specifically includes: S3.1 Construct a VAE model, which includes an input layer, an encoding layer, and a decoding layer; S3.2 Determine the model's loss function. The model loss function is: ,in For model loss, To reconstruct the loss, For KL divergence loss, These are the weighting coefficients for the KL divergence loss; S3.3 Train the constructed VAE model to obtain the trained VAE model.

5. The intelligent connected vehicle anomaly detection method based on latent distribution difference feature fusion according to claim 4, characterized in that, In step S3.2, the reconstruction loss function is: ,in, Let BCE represent the original input sample and the reconstructed output sample, respectively, and let E[ [] represents the expectation operation; the KL divergence loss function is: Where the subscript j represents the latent variable dimension index, Let the variance of the j-th latent variable be denoted as . Let represent the mean of the j-th latent variable, where n is the dimension of the latent variable.

6. The intelligent connected vehicle anomaly detection method based on latent distribution difference feature fusion according to claim 1, characterized in that, In step S4, the latent variable distribution features are extracted from the input vector using the trained VAE model. These latent variable distribution features include: VAE latent variable vector: , This represents the i-th input vector (i.e., sample). This represents the i-th VAE latent variable vector corresponding to the i-th input vector. This indicates the process of finding the mean vector; KL divergence characteristics: in, This represents the KL divergence feature corresponding to the i-th input vector. Let the variance of the j-th latent variable in the i-th input vector be denoted as . Let represent the mean of the j-th latent variable of the i-th input vector, where n is the dimension of the latent variable; Reconstruction error characteristics: in, This represents the reconstruction error feature corresponding to the i-th input vector. This represents the k-th dimension of the original feature value of the i-th input vector. Let m represent the k-th dimension reconstructed feature value of the i-th input vector, where m is the dimension of the input vector.

7. The intelligent connected vehicle anomaly detection method based on latent distribution difference feature fusion according to claim 1, characterized in that, In step S6, the formula for calculating the output weights of the ELM classifier is as follows: Where H is the hidden layer output matrix; T is the label matrix; is the generalized inverse matrix; SSA is used to optimize the number of hidden layer nodes and regularization coefficients of the ELM classifier; in step S7, the parameters of SSA include population size, maximum number of iterations, discoverer ratio and vigilant ratio. After setting the above SSA parameters, the optimal ELM parameters are obtained through iterative search.

8. The intelligent connected vehicle anomaly detection method based on latent distribution difference feature fusion according to claim 1, characterized in that, Step S1 specifically includes: S1.1 Collect communication data of the intelligent connected vehicle, wherein the communication data includes message ID, data field, attack type identifier and anomaly label; S1.

2. Preprocess the communication data, including numericalizing and normalizing the original data.

9. The intelligent connected vehicle anomaly detection method based on latent distribution difference feature fusion according to claim 1, characterized in that, Step S2 specifically includes: S2.1 Extract feature fields from the communication data and perform feature enhancement processing. The enhanced features include data byte features, message ID binary bit features, and statistical features. S2.

2. Concatenate the features extracted and enhanced in step S2.1 to form an input vector.

10. An intelligent connected vehicle anomaly detection system based on latent distribution difference feature fusion, characterized in that, include: Data acquisition and preprocessing module: used to acquire communication data from the CAN bus of intelligent connected vehicles and preprocess the communication data; Data feature expansion and input vector construction module: used to extract and enhance feature fields from preprocessed communication data and construct input vectors; Latent variable feature extraction module: This module has a built-in trained VAE model, which is used to extract the distribution features of latent variables; The latent variable difference feature enhancement and fusion module is used to construct difference features based on the reconstruction error REC and KL divergence, and then perform multi-dimensional fusion to obtain a fused feature vector. Intelligent Decision Module: This module uses the optimized ELM model to make intelligent decisions and determine whether the corresponding sample is an anomalous sample; Alarm output module: When the classification result is abnormal, an alarm signal is output.

Images