A CA-FCM and self-encoder adaptive fusion CAN message anomaly detection method

Abstract

The application provides a CAN message anomaly detection method of adaptive fusion of CA-FCM and a self-encoder, and is used for solving the problems that feature learning and clustering analysis are split and clustering is prone to local optimization in the prior art.The method comprises the following steps: S1, performing multi-dimensional differentiated feature engineering on a CAN FD message to form a feature matrix; S2, using a deep self-encoder to reduce dimension and calculate a reconstruction error; S3, performing CA-FCM in a low-dimensional space, simulating an annealing process through a dynamically attenuated fuzzy index m(t), realizing global optimization clustering and outputting a membership anomaly index; and S4, based on a sliding window variance, dynamically adjusting the weights of two indexes, calculating a comprehensive anomaly score, and comparing the comprehensive anomaly score with an unsupervised determined threshold to realize anomaly detection.The application deeply fuses feature learning and global optimization clustering, and significantly improves the accuracy, robustness and explainability of vehicle-mounted network intrusion detection.

Description

Technical Field

[0001] This invention relates to the field of abnormal traffic detection in vehicle networking, specifically to a method for detecting abnormal CAN messages by adaptive fusion of CA-FCM and self-encoder. Background Technology

[0002] As the core protocol of in-vehicle networks, the Controller Area Network (CAN) bus's inherent lack of authentication and encryption introduces serious security threats. With the development of intelligent connected vehicles, the CANFD bus, supporting higher bandwidth and a larger data domain, has been widely adopted, offering a significant expansion and improvement in data domain and speed flexibility compared to the traditional CAN bus. While bringing performance gains, the high-dimensional data characteristics of the CAN FD bus and the high real-time requirements of the in-vehicle environment present a dual challenge to the detection of abnormal data intrusions.

[0003] Existing anomaly detection technologies for the CAN bus mainly include the following two types: One approach is rule-based or traditional machine learning. These methods rely on preset thresholds or manually constructed features for pattern matching or classification. Their drawbacks include relatively simple feature extraction and decision-making patterns, difficulty in adapting to high-dimensional, non-linear data features, and poor model interpretability.

[0004] Another approach is to combine deep learning with static clustering. This method first uses deep learning models such as autoencoders for feature extraction, and then inputs the extracted low-dimensional features into static clustering algorithms such as K-means for anomaly analysis. While this approach represents an improvement, it still has inherent limitations: the feature learning objective of the deep model (minimizing reconstruction error) is inconsistent with the objective of the subsequent clustering algorithm (maximizing intra-cluster similarity), resulting in a disconnect between the two and a failure to effectively complement each other. Furthermore, traditional clustering algorithms such as Fuzzy C-means (FCM) are highly sensitive to initial value selection, easily affected by noise, and lack global search capabilities during the optimization process. When fitting high-dimensional, multimodal normal traffic characteristics, they are prone to getting trapped in local optima, making it difficult to obtain robust and interpretable cluster centers, directly limiting the accuracy and reliability of anomaly detection.

[0005] Therefore, the key technical problem that urgently needs to be solved in this field is: how to design a clustering mechanism with strong global optimization capabilities and good robustness to initial values, and enable it to achieve consistent goals, orderly cascading and complementary advantages with the deep feature extraction module, so as to build an anomaly detection model with both accuracy and reliability for high-dimensional dynamic vehicle network traffic. Summary of the Invention

[0006] This invention aims to overcome the shortcomings of existing technologies and provide a CAN message anomaly detection method that adaptively integrates CA-FCM and self-encoder.

[0007] This invention provides a CAN message anomaly detection method that adaptively fuses CA-FCM with an autoencoder. It focuses on addressing the technical problems of clustering algorithms easily getting trapped in local optima and being disconnected from the feature learning module. The invention provides an intrusion detection method that fuses an autoencoder with cooperative annealing fuzzy C-means clustering. The core of this invention is to introduce a simulated annealing mechanism to perform global cooperative optimization of the fuzzy C-means clustering algorithm (FCM), ensuring its orderly connection and feature-level complementarity with the feature learning module. Ultimately, this achieves high precision, high interpretability, strong adaptability, and high real-time performance in anomaly detection of CAN FD bus data in vehicle networks. The method includes the following steps: Step S1: Multi-source feature extraction and preprocessing. The original message is parsed to extract identity features, transmission decision features, data domain features, and time-series features. After processing using differentiated encoding and standardization methods, the features are concatenated to form a fixed-dimensional feature vector, resulting in a feature matrix X.

[0008] Step S2: Autoencoder Model Training and Latent Representation Extraction. Design and train a deep autoencoder to map the feature matrix X to a low-dimensional latent space, obtaining the latent space matrix Z. Simultaneously, calculate the reconstruction error between the input and the reconstructed output.

[0009] Step S3: Cooperative Annealing Fuzzy C-Means Clustering (CA-FCM). An improved fuzzy C-means clustering algorithm is performed in the low-dimensional latent space Z. The fuzzy exponent m(t) of this algorithm is a dynamically decaying function with the number of iterations t, driving the clustering process to smoothly transition from "soft clustering" to "hard clustering," ultimately outputting a cluster anomaly index characterizing the degree to which samples deviate from all cluster centers. .

[0010] Step S4: Adaptive Weighted Fusion and Anomaly Detection. A sliding window mechanism is introduced to calculate the variance of the reconstruction error and the clustering anomaly index within the window in real time. The fusion weights of the two indices are dynamically adjusted based on the variance ratio to calculate a comprehensive anomaly score. Finally, the comprehensive anomaly score is compared with a dynamic threshold determined based on the training set. The comparison is performed to determine whether the current message is abnormal.

[0011] Compared with the prior art, the present invention has the following beneficial effects: By leveraging the global optimization capabilities of the CA-FCM algorithm, clustering avoids getting trapped in local optima, enabling a more accurate depiction of normal traffic profiles. Simultaneously, the deep and organic integration of "feature learning and cluster analysis" ensures that feature extraction serves the ultimate goal of anomaly detection, effectively improving overall detection accuracy and robustness.

[0012] The criteria for anomaly determination are decomposed into two quantifiable indicators: reconstruction error (reflecting the rarity of the pattern) and cluster membership (reflecting the degree of deviation from the normal cluster). The contribution of each indicator to the decision-making is displayed through dynamic weights, providing a clear and transparent basis for security analysis.

[0013] By combining multi-dimensional, differentiated feature engineering with nonlinear dimensionality reduction using autoencoders, the high-dimensional heterogeneous data of CANFD can be effectively processed. The "annealing" mechanism of CA-FCM and the adaptive fusion strategy based on sliding window variance enable the model to dynamically adapt to changes in vehicle operating status and data flow, avoiding performance degradation of static models in dynamic scenarios. Attached Figure Description

[0014] Figure 1 This is the overall flowchart of the CAN message anomaly detection method based on the adaptive fusion of CA-FCM and self-encoder of the present invention; Figure 2 This is a schematic diagram of the fusion architecture of the self-encoder and CA-FCM of the present invention; Figure 3 This is a diagram of the adaptive weighted fusion mechanism based on sliding window variance in this invention. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below in conjunction with embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0016] like Figure 1 As shown, the overall process of the CAN message anomaly detection method based on the adaptive fusion of CA-FCM and self-encoder of the present invention mainly consists of four sequential stages: Feature engineering stage: Receive the raw CAN FD message stream, and generate a fixed-dimensional feature matrix through multi-dimensional parsing and differential coding standardization. .

[0017] Autoencoder training and inference phases: A deep autoencoder is trained using the feature matrix X. After training, the encoder maps X to a low-dimensional latent space, obtaining matrix z; simultaneously, the decoder's reconstructed output is compared with the original X to obtain the normalized reconstruction error. .

[0018] CA-FCM clustering stage: A collaborative annealing fuzzy C-means clustering model is trained on a low-dimensional matrix z. After the model converges, cluster anomaly indices are calculated for each sample. .

[0019] Adaptive fusion decision stage: and The input is fed into the adaptive weighted fusion module, which calculates dynamic weights through a sliding window to generate a comprehensive anomaly score. and with threshold Compare and output the final judgment result.

[0020] Specifically, it includes the following steps: S1: Extract features and group the original CAN FD messages, and adopt different encoding methods for the differences in grouping. After appropriate standardization, the features are concatenated to form a feature vector, which is then input into the deep learning model.

[0021] A. Multi-source feature extraction and preprocessing: Preprocessing is performed on four types of data features to provide high-quality input for the model, including the following sub-steps: Step A1: Process the identity features (CAN IDs) by converting high-cardinality identity features into semantic feature vectors using target encoding. This involves calculating statistics on the training set before encoding. For example, calculate the probability of a certain ID appearing and the frequency of it being marked as normal on the training set, and then look up its functional domain (such as power, body, etc.) according to the CAN bus protocol specification (such as DBC files), encoding it into a semantic feature vector. Taking CAN ID 0x100 as an example, this ID appears 100 times in the training set, is marked as normal traffic 98 times, and has an occurrence probability of 0.05. According to the CAN bus protocol specification, the functional domain corresponding to this ID (functional domain information is uniquely encoded) is power, so the encoded ID is [0.98, 0.05, 'power']. Furthermore, new IDs appearing in the test set are either filled with the global average probability or marked with the "unknown" category.

[0022] Step A2: For the transmission decision features (DLC, BRS, ESI, FDF) in the traffic, the processing goal is to convert these discrete control bits into features that reflect the transmission strategy. BRS, ESI, and FDF are Boolean features, so they are initially binarized; DLC is converted into actual byte counts according to the CAN FD encoding table. The converted transmission decision features are then combined and context-encoded.

[0023] Step A3: Process the data field by converting the raw data of 0-64 bytes into statistical features, such as basic statistical features, including but not limited to the data mean and standard deviation; pattern features, such as the proportion of zero bytes and the proportion of 0xFF bytes; for large-capacity data, it is necessary to divide it into blocks before statistics are performed, and finally the data is standardized.

[0024] Step A4: Extract the relative timing pattern from the timestamps of the absolute messages, including calculating the relative interval between consecutive messages, and statistically analyzing the message frequency and interval stability within a sliding window.

[0025] Step A5: Standardize the four types of features extracted above using differentiated methods. For example, probabilistic features are standardized using Z-score, statistical features are standardized using RobustScaler (robust to outliers), and binary features are normalized using Min-Max. Finally, the four types of features are horizontally concatenated in a fixed order to form the feature vector of each message. Where R represents the set of real numbers and d is the feature dimension, constructing the feature matrix. As input to the model, X is an N x d real matrix, where N is the number of messages. Finally, the transformation parameters (such as mean, standard deviation, etc.) from the training phase are saved to ensure consistency between the processing rules and the data distribution during the testing phase.

[0026] S2: Design and train an autoencoder model to perform unsupervised learning on the feature matrix dataset, extract its low-dimensional latent representations and set a reconstruction error threshold to provide a data foundation for subsequent clustering and anomaly detection.

[0027] B. Construct a deep autoencoder, train the network by minimizing the reconstruction error, and obtain the low-dimensional spatial features of the data. This includes the following sub-steps: Step B1: Design the autoencoder network structure. The autoencoder consists of two parts: an encoder and a decoder. The encoder maps high-dimensional input features to a low-dimensional latent space, and the decoder reconstructs the mapped low-dimensional features back into the original input.

[0028] The input layer dimension is (Corresponding to the feature dimensions obtained in step A5).

[0029] The encoder consists of multiple fully connected layers. Because it can learn the nonlinear relationships between features, it is suitable for handling complex feature interactions in CAN FD data. It also employs an exponential decay method for layer-by-layer dimensionality reduction: let the number of hidden layers in the encoder be... The dimension of the nth hidden layer is The compression factor is The formula is as follows: ; The decoder structure is symmetrical to the encoder, increases in dimensionality layer by layer, and uses the ReLU activation function.

[0030] The latent layer dimension z is crucial to model performance and is adaptively determined based on the input data dimension and complexity. Specifically, principal component analysis is performed on the feature matrix X to calculate the variance contribution rate of each principal component. and its accumulation and Select the smallest dimension that retains a preset proportion of the original data information as the baseline dimension. ,in An information retention threshold is set, ranging from 0.85 to 0.95; considering the learning capacity requirements of the nonlinear mapping of the neural network, a redundancy coefficient is introduced above the baseline dimension. The range is 1.2-1.5, resulting in the final latent dimension z, where This serves as the lower bound for the latent dimension, which can be set to 8 to ensure sufficient representational power in the latent space. The upper bound of the potential dimension is used to force the autoencoder to form an effective information compression bottleneck, and its value is usually no greater than the original feature dimension. One-half (can be set as) or This ensures effective dimensionality reduction. In practice, the preset parameters must strictly meet the requirements. If the upper limit calculated based on the feature dimension is less than Then take directly The formula is as follows.

[0031] ; This adaptive method ensures that if the original data has high redundancy, it can be effectively compressed to obtain key features; if the original data is rich in information, it also avoids the problem of improper compression caused by a fixed ratio.

[0032] The output layer has a dimension of d, and the activation function is either linear or Sigmoid (depending on whether the input features are normalized to the [0,1] interval; if the features are normalized, the Sigmoid activation function is used to ensure that the output is also within the [0,1] interval).

[0033] Step B2: Determine the reconstruction loss function and training objective. Mean squared error (MSE) is used as the loss function of the autoencoder to measure the difference between the feature matrix and the reconstructed output, as shown in the following formula, where, For the j-th original feature of the i-th message, The output is the reconstructed output of the autoencoder, and N is the number of training samples.

[0034] ; Reconstruction error reflects the autoencoder's understanding of the training data and is used as a quantitative indicator of anomalies. If the test data conforms to the distribution pattern of the training data, the reconstruction error is small; if the anomalous data deviates from the distribution pattern of the training data, the reconstruction error is large. This characteristic is one of the foundations for subsequent anomaly detection.

[0035] Step B3: Set the relevant hyperparameters for model training: Select the Adam optimizer, set the initial learning rate to 0.001, and adjust it according to the dynamic training effect; select batch size of 32, 64, or 128; set the maximum number of training epochs to 200-500, and introduce an early stopping mechanism to stop training when the validation set loss no longer decreases for 10-20 consecutive epochs to prevent overfitting; take 10%-20% of the random training data for the validation set to test the model's generalization ability and early stopping judgment.

[0036] Step B4, Model Training and Saving: The autoencoder is trained using the feature matrix X constructed in Step A5, with the training objective of minimizing the reconstruction error. The model learns the identity mapping and outputs a low-dimensional matrix representation through a dimension-adaptive latent layer. Training employs a mini-batch gradient descent strategy, combined with the Adam optimizer to update network parameters. After each training epoch, the loss is evaluated on the validation set to monitor model convergence and select the optimal weights. After training, the following components are saved for subsequent steps: the complete autoencoder model, used to calculate the reconstruction error of the test data during the testing phase; the encoder part, used to map the test data features to a low-dimensional space; and the weights with the lowest loss in the validation set.

[0037] Step B5: Obtain the low-dimensional space matrix and reconstruction error. Calculate these two key outputs using the trained autoencoder on the CAN FD feature matrices from the training and test sets.

[0038] (1) Low-dimensional vector: output by the encoder part.

[0039] ; in This is a low-dimensional vector representation of the i-th message, preserving... The key features are that noise and redundancy have been removed. This is the encoder function.

[0040] (2) Calculation of reconstruction error: The decoder reconstructs the low-dimensional matrix and calculates the mean square error between the reconstructed matrix and X.

[0041] ; in For the reconstruction error of the i-th message, and These are the j-th components of the original feature and the reconstructed feature, respectively.

[0042] (3) Standardization and normalization of reconstruction error: to facilitate subsequent calculation with clustering index and to perform statistical analysis on reconstruction error.

[0043] The mean and standard deviation of the reconstruction error of the training set are calculated: ; Z-score normalization is applied to the reconstruction error: ; The standardized reconstruction error follows a distribution with a mean of 0 and a variance of 1. To facilitate subsequent weighted fusion, it is mapped to the interval [0, 1]. ; (4) Save the outputs of the training set and the test set, including a low-dimensional matrix, each row of which corresponds to the potential representation of a message. The low-dimensional matrix is ​​input into the CA-FCM clustering model in step S3; the reconstruction error vector, each element of which corresponds to the reconstruction error of a message, is used as one of the bases for anomaly judgment in step S4; and the statistics of the reconstruction error calculated based on the training set.

[0044] S3: The latent space matrix Z serves as the training input for constructing collaborative annealing fuzzy C-means clustering, performing dynamic clustering of the data to provide a clustering-level judgment basis for anomaly detection.

[0045] C. Cooperative Annealing Fuzzy C-Means Clustering (CA-FCM) is an improved algorithm of traditional Fuzzy C-Means Clustering (FCM). Its core idea is to introduce an annealing mechanism to dynamically decay the parameters determining fuzziness during the clustering process, thus achieving a smooth transition from fuzzy "soft clustering" to "hard clustering." The improved algorithm initially allows traffic flow to have different membership degrees between different clusters, reflecting the diversity of normal vehicle operating states. Later, as the fuzziness becomes clearer, it assigns explicit low membership degrees to outlier samples. The construction and training of the CA-FCM model includes the following sub-steps: Step C1: Determine the objective function of CA-FCM, which is a dynamic function that depends on the number of iterations t.

[0046] ; in The fuzzy index varies with t. Let be the center vector of the j-th cluster. Let i be the membership degree of cluster j, satisfying k is the number of clusters.

[0047] Step C2: Determine the decay process of the fuzziness index, known as the cooling plan: Fuzziness Index The decay follows a polynomial function as the iteration number t increases, specifically in the form: ; in, The initial fuzziness index can be set to 2, at which point the algorithm's performance is equivalent to FCM. The decay exponent controls the cooling rate and can be set to a range of 0.5-1. As t increases, from As the clustering approaches 1, the clustering process gradually transitions from fuzzy "soft clustering" to clear "hard clustering".

[0048] Step C3: Initialize cluster center and membership matrix: (1) Determining the number of clusters k: This depends on the needs of abnormal data monitoring. The goal of intrusion detection is to distinguish network traffic into normal modes and several abnormal attack modes. Let the number of known attack types be t, then the initial number of clusters k = t + 1 (where 1 represents the normal class). For example, if there are 3 abnormal types, namely flooding attack, obfuscation attack, and fault attack, then k = 4. If the attack type is unknown or it is a general detection scenario, then k should be at least 2 to distinguish between normal and abnormal, and can be further adjusted according to the actual data distribution.

[0049] (2) Cluster center initialization: The K-means algorithm is used to pre-cluster Z, and the result is used as the initial cluster center of CA-FCM to reduce the number of subsequent iterations and improve stability.

[0050] (3) Initialization of membership matrix: ; in, This represents the distance from the i-th sample to the current j-th cluster center.

[0051] Step C4: Iterative optimization of the CA-FCM objective function: CA-FCM employs an alternating optimization strategy, fixing the cluster centers or membership degrees in each iteration while updating another variable, and simultaneously adjusting the fuzzy index. The decay rate increases with the number of iterations.

[0052] Given a fixed cluster center and fuzzy exponent in the current iteration round, the solution for the membership degree is: ; In the current iteration, with the membership matrix and fuzzy index fixed, update the cluster centers: ; Calculate the objective function value of the current iteration. The clustering iteration is terminated when any of the following conditions are met: the objective function value of two adjacent iterations is less than a preset threshold; the maximum displacement of all cluster centers in two adjacent iterations is less than a preset threshold; or the number of iterations reaches a preset maximum upper limit.

[0053] Step C5: Train the annealing clustering model and save key parameters; calculate the maximum membership degree anomaly index based on the clustering results, and prepare for fusion with the autoencoder reconstruction error.

[0054] ; Normal samples typically have a high degree of membership to a certain cluster. The membership degree of the outlier samples is relatively small and uniform. Larger.

[0055] S4: Based on the reconstruction error obtained in step S2 and the clustering membership degree obtained in step S3, design an adaptive judgment criterion to perform anomaly detection on the test set CAN FD messages and output the detection results.

[0056] D. Integrate anomaly detection metrics, including the following sub-steps: Step D1: To capture the changing characteristics of the data stream in real time, this step introduces a sliding window mechanism and dynamically adjusts the fusion weights of the two types of indicators based on the variance of the data within the window.

[0057] (1) Sliding window settings: Set the sliding window length L (selectable from 100 to 500 messages) and maintain the normalized reconstruction error of the nearest L messages within the window. Clustering anomaly indicators sequence.

[0058] (2) Calculate the variance within the window: at time t, calculate the variance of the reconstruction error and the variance of the cluster anomaly index within the window.

[0059] ; The magnitude of variance reflects the degree of fluctuation and potential discriminative information of the outlier within the current data segment. Generally speaking, a larger variance indicates that the indicator fluctuates more drastically within the current window, and may contain richer anomaly discriminative information.

[0060] (3) Adaptive weight calculation: The weight of reconstruction error is determined based on the proportion of variance. Weights of cluster anomaly indicators : ; in The denominator is a very small positive number to prevent the denominator from being 0. This mechanism ensures that indicators with greater fluctuations and richer information receive higher decision weights, thus achieving adaptive adjustment.

[0061] Step D2: Calculate the comprehensive anomaly score for each message using the adaptive weights at the current time. ; Comprehensive Abnormal Score A larger value indicates a higher probability of message anomaly.

[0062] Step D3: To achieve unsupervised anomaly detection, determine the judgment threshold based on the comprehensive anomaly score distribution of the training set.

[0063] (1) Training set threshold calculation: The comprehensive anomaly score for all normal samples in the training set. Calculate the mean and standard deviation .

[0064] ; Set the judgment threshold: ; in This is the confidence coefficient, which can be set to 3-5, corresponding to a confidence interval of over 99.7% in a normal distribution. This threshold ensures that the overall anomaly score of the vast majority of normal samples is below [a certain value]. However, the scores of abnormal samples will significantly exceed this range.

[0065] (2) Real-time determination: Calculate the current message anomaly score during the detection phase. ,like If so, it is considered abnormal.

[0066] The following are specific examples.

[0067] Example 1 This embodiment describes an experiment of an intrusion detection system based on the HCRL CAN-FD public dataset.

[0068] Scenario: Using real vehicle network traffic provided by HCRL, approximately 5 million packets were extracted. The dataset includes normal packets as well as three attack types: flooding, fuzzing, and malfunction.

[0069] Implementation: Follow steps S1-S4. After processing in steps A1-A5, the final feature dimension d=45. In step B1, the latent dimension z=12 is determined through PCA analysis. In step C3, based on the prior knowledge that there are three attack types in the dataset, the number of clusters k is set to 4 (one normal cluster and three abnormal clusters), the annealing parameter m0=2.0, and α=0.8. In step D1, the sliding window L=300, and the confidence coefficient β=4.

[0070] Online detection: After processing a test packet by S1 and S2, the normalized reconstruction error ē = 0.45 and the cluster anomaly index a = 0.81 are obtained. The current sliding window calculates ω1 = 0.4 and ω2 = 0.6. Therefore, the comprehensive anomaly score S = 0.4 × 0.45 + 0.6 × 0.81 = 0.666. If this value is greater than the threshold τ determined by the training set (τ ≈ 0.35 in this experiment), the system determines it as an intrusion and issues an anomaly alarm.

[0071] Example 2 This embodiment is basically the same as Embodiment 1, except that it is optimized for a critical ECU node with extremely high real-time requirements to reduce the computational load. The latent dimension z is compressed to 16, the number of clusters k is reduced to 5, and the decay exponent is... The value was set to 0.5 to achieve rapid hardening. The sliding window L was reduced to 100, and the confidence coefficient β was increased to 5 to strictly control the false alarm rate.

[0072] To further verify the effectiveness and advancement of the proposed method, comparative experiments were conducted on the standard vehicular network intrusion dataset (HCRL CAN-FD Intrusion Dataset). This dataset contains rich, real-time continuous features and includes various attacks injected sequentially (including flooding, fuzzing, and fault attacks), effectively testing the model's detection capabilities in complex and dynamic vehicular environments.

[0073] The experiment compared the method provided in this invention (autoencoder + CA-FCM) with existing mainstream anomaly detection methods, including the Isolation Forest algorithm (iForest) and the traditional "autoencoder + static K-means" clustering method. The evaluation metrics used were the widely accepted metrics in anomaly detection: accuracy, recall, and F1 score. Specific comparative experimental data are shown in Table 1.

[0074] Experimental data analysis shows that: (1) Compared with the traditional iForest algorithm, the present invention utilizes high-dimensional nonlinear latent features extracted by deep autoencoders, achieving significant improvements in all indicators, proving the necessity of multidimensional feature engineering and deep feature learning in identifying abnormal data in complex vehicle bus data; (2) Compared with the combination scheme of "autoencoder + K-means", the present invention improves accuracy and F1 score by 4.2% and 4.5%, respectively. This shows that the CA-FCM collaborative annealing mechanism introduced in the present invention effectively overcomes the defect of traditional K-means being prone to getting trapped in local optima; at the same time, the adaptive fusion strategy based on sliding window variance enables the model to maintain recall and overall robustness well when facing data streams with strong temporal correlation.

[0075] It should be understood that the above embodiments are merely exemplary. Those skilled in the art can make various non-substantial improvements and substitutions based on the technical concept of this invention, and all such improvements and substitutions should be considered to fall within the protection scope of this application.

Claims

1. A method for anomaly detection of CAN messages that adaptively fuses CA-FCM and an autoencoder, characterized in that, Includes the following steps: Step S1: Extract and preprocess the features of the acquired original vehicular network packets to obtain a fixed-dimensional feature matrix X; Step S2: Process the feature matrix X using the trained deep autoencoder to obtain the low-dimensional latent space matrix z, and calculate the normalized reconstruction error. ; Step S3: Perform cooperative annealing fuzzy C-means clustering on the low-dimensional latent space matrix z, wherein the fuzzy index of the clustering is... It is a function that dynamically decays with the number of iterations t, and outputs a cluster anomaly index by optimizing the clustering objective. ; Step S4: Calculate the normalized reconstruction error within the sliding window. and the clustering anomaly index The variance is used to dynamically calculate the fusion weights for the... and stated A weighted fusion is performed to obtain a comprehensive anomaly score. and a dynamic threshold determined based on the training set. The comparison is performed to determine whether the current message is abnormal.

2. The CAN message anomaly detection method based on the adaptive fusion of CA-FCM and autoencoder according to claim 1, characterized in that, Step S1 specifically includes: The identity features are encoded using target encoding, which transforms them into semantic feature vectors containing statistical probability and functional domain information. The transmission decision features are binarized and numerically transformed based on the protocol specification, and then combined and context-coded. Statistical features are extracted from the data domain, including the data mean, standard deviation, and proportion of specific patterns. Temporal feature extraction includes relative message interval, sliding window frequency, and interval stability; After standardizing the above four types of features using different methods, they are horizontally spliced ​​in a fixed order to form the feature matrix X.

3. The CAN message anomaly detection method based on the adaptive fusion of CA-FCM and self-encoder according to claim 2, characterized in that, In the target encoding of the identity features, unknown identity features appearing during the testing phase are filled with the global average probability calculated based on the training set and marked as "unknown" category.

4. The CAN message anomaly detection method based on the adaptive fusion of CA-FCM and self-encoder according to claim 1, characterized in that, The latent spatial dimension z of the deep autoencoder in step S2 is adaptively determined in the following way: Principal component analysis is performed on the feature matrix X to calculate the variance contribution rate of each principal component. and cumulative contribution rate ; Will meet the preset information retention threshold The smallest dimension is used as the baseline dimension. ; Introducing redundancy coefficient Determine the final latent dimension z: ； in and These are the preset lower and upper limits of the potential dimensions, respectively.

5. The CAN message anomaly detection method based on the adaptive fusion of CA-FCM and self-encoder according to claim 1, characterized in that, The fuzzy index of the collaborative annealing fuzzy C-means clustering described in step S3 A polynomial cooling scheme is used for attenuation: ； in The initial fuzzy index, The decay index is used to control the cooling rate.

6. The CAN message anomaly detection method based on the adaptive fusion of CA-FCM and self-encoder according to claim 5, characterized in that, The initial fuzziness index The value of is 2, and the attenuation index The value range is 0.5-1.

7. The CAN message anomaly detection method based on the adaptive fusion of CA-FCM and autoencoder according to claim 6, characterized in that, In step S3, the cluster centers of the collaborative annealing fuzzy C-means clustering are initialized after pre-clustering using the K-means algorithm.

8. The CAN message anomaly detection method based on the adaptive fusion of CA-FCM and self-encoder according to claim 1, characterized in that, The fusion weight is calculated as follows: Set the sliding window length L, and calculate the variance of the normalized reconstruction error and the variance of the cluster anomaly index in real time: ； The weights of the reconstruction error are determined based on the proportion of variance. Weights of cluster anomaly indicators : ； in Approaching 0.

9. The CAN message anomaly detection method based on the adaptive fusion of CA-FCM and self-encoder according to claim 1, characterized in that, The dynamic threshold The calculation method is as follows: ； in and These are the mean and standard deviation of the comprehensive anomaly score calculated based on the training set, respectively. This is the preset confidence coefficient.

10. The CAN message anomaly detection method based on the adaptive fusion of CA-FCM and autoencoder according to claim 1, characterized in that, Comprehensive Abnormal Score The calculation formula is as follows: ； Among them, the comprehensive abnormal score .

Images