Lightweight vehicle network intrusion detection system based on multi-objective optimization algorithm

Abstract

The application discloses a lightweight vehicle-mounted network intrusion detection system based on a multi-objective optimization algorithm and relates to the technical field of vehicle-mounted network detection; the system integrates a hybrid deep RBM generator to alleviate the problems of attack sample scarcity and class imbalance in real vehicle-mounted network data; two features, IDF and IDC, are introduced in view of the characteristics that it is difficult to distinguish between fake and disguised attacks; an adaptive enhanced non-dominated sorting beetle optimization algorithm is used to optimize XGBoost hyperparameters, and then intrusion detection is realized, and finally, the collaborative optimization of three key performance indicators, F1 score, model size and inference delay, is realized; the lightweight vehicle-mounted network intrusion detection system based on the multi-objective optimization algorithm is adopted, and high-precision, lightweight and strong generalization ability multi-classification intrusion detection functions are provided for the resource-limited vehicle-mounted environment.

Description

Technical Field

[0001] This invention relates to the field of vehicle network detection technology, and in particular to a lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm. Background Technology

[0002] To compensate for the inherent security vulnerabilities of the CAN bus, Intrusion Detection System (IDS) has become the mainstream technology for in-vehicle network security protection due to its core characteristics of not requiring modification of existing bus protocols, flexible deployment, and adaptability to the resource-constrained environment of vehicles. In recent years, data-driven IDS solutions have gradually replaced traditional rule-based methods, demonstrating better adaptability through self-learning capabilities. However, the in-vehicle environment places stronger constraints on the lightweight and real-time performance of models, and existing data-driven solutions still have significant limitations: in real-world scenarios such as the ROAD dataset, the detection accuracy is insufficient when facing complex attacks with strong concealment; although some deep learning models have powerful feature extraction capabilities, their large number of parameters and high inference latency make it difficult to achieve efficient deployment on ECUs with limited computing power.

[0003] To address the problems existing in automotive IDS, traditional machine learning models, with their advantages of simple structure, low computational overhead, and strong interpretability, are more suitable for the actual needs of automotive embedded platforms. Therefore, there is an urgent need to propose a lightweight multi-objective optimized IDS solution based on machine learning, MOO-IDS. Summary of the Invention

[0004] The purpose of this invention is to provide a lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm. By balancing the data distribution of synthetic samples and implementing dual-dimensional feature enhancement to strengthen attack characterization, the system achieves a synergistic improvement in detection performance and deployment feasibility.

[0005] To achieve the above objectives, this invention provides a lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm, including a data preprocessing module, a two-dimensional feature engineering module, a data augmentation module, and a multi-objective optimization algorithm module; The data preprocessing module is based on the original CAN bus dataset and performs data standardization processing. It mainly completes the conversion of timestamps into time intervals, the conversion of hexadecimal message data into binary data, standardizes the data format, and cleans up the original noise, so as to achieve the unification of the timing and content data format of CAN bus data messages. The dual-dimensional feature engineering module constructs two types of core features based on preprocessed CAN bus data: identifier counting features and identifier data association features; it mines the frequency of occurrence of CAN message IDs and the association patterns between IDs and corresponding data, extracts effective features that can characterize abnormal behavior of the vehicle network, and completes the construction of high-dimensional features. The data augmentation module uses a sample size analyzer to classify samples into small, medium, and large types. Small samples are smoothed using KDE and shallow RBM, medium samples use medium RBM, and large samples combine deep RBM and bit-flipping strategies to generate a synthetic data pool. The multi-objective optimization algorithm module uses the XGBoost intrusion detection model as its base and optimizes its core hyperparameters. It adopts the improved multi-objective algorithm AE-NSDBO, which takes into account the three major indicators of F1 score, model size and inference latency. It is combined with dynamic weight adjustment, adaptive stage detection and hybrid mutation strategy, and selects the optimal hyperparameter combination that balances accuracy, lightweight and low latency through Pareto front screening.

[0006] Preferably, the specific tasks of the data preprocessing module are as follows: The raw CAN bus data is cleaned, including handling missing values ​​and standardizing data length. After cleaning, the timestamp of each message is parsed and extracted. Arbitration Identifier (ID), Data Length (DLC), and Data Payload (Data) are used as the basic fields.

[0007] Preferably, the dual-dimensional feature engineering module introduces two key features: ID frequency and ID-Data correlation, as detailed below; The process of calculating ID frequency is as follows: To detect short-term ID frequency anomalies caused by malicious message injection, for the first Each message, its statistics Its timestamp The endpoint is and the length is The number of times it appears within the sliding window is calculated using the following formula: ; The process of calculating ID-Data association is as follows: To quantify the extent of data tampering, the position of each data byte for each ID is preset from clean, normal traffic. Establish a statistical benchmark, mean Standard deviation Normal range is defined as For the message to be tested, calculate the maximum standardized deviation of its data byte values ​​that exceeds the normal range: ; Then, the original timestamp is converted into the time difference between adjacent messages. Each feature value is converted into a binary vector for subsequent processing by the RBM generator. Numerical features are standardized before being input into the classification model. Finally, each message is represented as a unified feature vector. : .

[0008] Preferably, the data augmentation module uses a hybrid depth-restricted Boltzmann machine generator (HyDRBM-Gen), which is a deep network with multiple stacked RBMs as its core. The hidden layer nodes of the previous RBM and the visible layer nodes of the next RBM share the same set of units, forming a chain structure of progressively abstracted features. During training, the model learns multi-level feature representations of data from low-level bit patterns to high-level semantic patterns through layer-by-layer greedy unsupervised pre-training. During generation, random sampling is performed from the top hidden layer and the data is reconstructed layer by layer from top to bottom, finally synthesizing samples that are consistent with the original CAN bus data distribution. The sample size of different attack types in the original CAN bus dataset is statistically analyzed, and the samples are labeled as small, medium, and large based on their size. The corresponding generation path is then dynamically selected. For attack types with very few samples, shallow stacked RBN models are directly trained. To avoid overfitting, kernel density estimation is used to oversample the model before using the shallow structure to generate the model. For medium-depth samples, a medium-depth RBM is directly used for learning and generation; For large samples, a deeper network structure is used for modeling, and tiny random binary perturbations are introduced during the generation process.

[0009] The preferred construction process of the multi-objective optimization algorithm module is as follows: S1. The XGBoost hyperparameter optimization problem is constructed into a multi-objective optimization problem model; S2. By combining the non-dominated sorting mechanism with DBO, the coverage of solutions is expanded through the efficient search capability of DBO, and balanced solutions are selected by using the non-dominated sorting mechanism. This forms an adaptive and enhanced non-dominated sorting dung beetle optimization algorithm AE-NSDBO framework that adapts to the needs of multi-objective optimization and optimizes the hyperparameters of XGBoost.

[0010] Preferably, the specific process of S1 is as follows: The XGBoost hyperparameter optimization problem is constructed as a multi-objective optimization problem, collaboratively optimizing detection performance, model size, and inference efficiency. This problem can be formalized as the following three-objective minimization problem: ; ; in, Let be the decision variable vector, representing a set of hyperparameters of XGBoost; The decision space is defined by the range of values ​​for each hyperparameter. Let the target vector be the decision space, and map it to the target space. ， , , These represent model size, negative F1 score, and sample inference delay, respectively; all three values ​​should be as small as possible.

[0011] The preferred method, the specific process of the adaptively enhanced non-dominated sorting dung beetle optimization algorithm AE-NSDBO in S2, is as follows: S21. Randomly generate within the decision space. An initial population of individuals is formed, with each individual representing a set of XGBoost hyperparameters to be optimized. Simultaneously, a Pareto front archive, independent of the population, is initialized to store non-dominated solutions discovered during algorithm execution. Baseline weight vectors for the three objectives are defined. The baseline weights reflect the initial preferences for the three objectives and are used to balance the different effects of their different dimensions. The current weights are initialized as the baseline weights. S22. During the optimization process, the weights are updated based on the distribution of solutions in the current Pareto front, and the standard deviation of each objective value in the front is calculated. The smaller the standard deviation, the more concentrated the solution distribution on the objective, requiring greater weighting to promote exploration. Temporary weights are calculated based on the baseline weights. : ; S23. Optimize XGBoost hyperparameters by selecting parent individuals, adaptive stage detection, introducing a hybrid mutation strategy, evaluating individuals and updating the population. S24. Select the solution that minimizes the final weighted objective value as the optimal hyperparameter combination.

[0012] Preferably, the specific process of S23 is as follows: The specific process of S23 is as follows: S231. Select parent individuals, calculate the weighted target vector for each individual based on the current weight, perform non-dominated sorting in the weighted target space, and use a binary tournament selection method, prioritizing individuals with lower non-dominated layers and higher crowding in the same layer. Repeat. This constitutes the parent population; S232, Calculating population diversity With convergence speed ,according to and The search is divided into exploration, balancing and development phases, and corresponding dung beetle behaviors are selected for parent individuals to generate initial offspring; S233. Introduce a hybrid mutation strategy. For the initial offspring individuals, perform mutation operations with different probabilities according to the current stage. In the exploration stage, use polynomial mutation with a higher probability to achieve large-scale jumps. In the equilibrium stage, use a mixture of polynomial mutation, Gaussian mutation and Cauchy mutation. In the development stage, use small-step Gaussian mutation as the main method. After the mutation is completed, a complete offspring population is obtained. S234. Evaluate individuals and update the population. Train the XGBoost model based on the hyperparameter configuration of offspring individuals, and calculate the original target value and weighted target value. Merge the parent and offspring generations, perform non-dominated sorting and crowding calculation in the weighted target space, and select the new generation of population according to the principle of low non-dominated layer number and high crowding in the same layer. At the same time, extract the non-dominated solution based on the original target value from the merged population to update the Pareto front archive, and control the archive size to maintain diversity. S235. If the preset number of iterations has not been reached, return to S22 and retrain until the preset number of iterations is reached.

[0013] Preferably, the specific contents of the exploration, balancing, and development phases in S232 are as follows: Exploration Phase: Employing rolling ball behavior, the system moves towards a random Pareto solution and introduces random perturbations. ; in, for, for, For random directions, These are guide individuals randomly selected from the current Pareto frontier. For adaptive attenuation of noise intensity ( Take 0.2), For a standard normally distributed random vector, This represents the current iteration number; Equilibrium Phase: Employing reproductive behavior to move towards elite solutions, with the step size decreasing with each iteration. ; ; in, The elite individuals are randomly selected from the current set of non-dominated optimal solutions, with a step size of [missing information]. The perturbation decreases adaptively with each iteration, ensuring that the initial perturbation is relatively large and gradually refined in later stages. This represents the maximum number of iterations. Development phase: Employing foraging behavior in a random dimension Perform boundary perturbation: ; in, , , This dimension serves as the boundary, while the other dimensions remain unchanged. The perturbation amplitude factor is used to ensure that the search unit is in the optimal neighborhood.

[0014] Preferably, the specific calculation process for S24 is as follows: The optimal hyperparameter combination is selected from the final Pareto front, which minimizes the final weighted objective value. ; in, The final weights represent the optimal balance of the three objectives, and this solution is output as the optimal solution.

[0015] Therefore, the lightweight vehicle network intrusion detection system based on the multi-objective optimization algorithm described above has the following advantages compared with the prior art: 1. This application proposes a hybrid deep RBM generator, HyDRBM-Gen, which generates highly realistic synthetic attack samples to address the problems of scarce attack samples and class imbalance in real-world scenarios, providing balanced data support for multi-class training. 2. Design a time-series and content dual-dimensional feature set to collaboratively capture the covert patterns of complex attacks, improve their distinguishability from normal traffic, and break through the limitations of single feature representation. 3. A multi-objective optimization algorithm AE-NSDBO is proposed to collaboratively optimize detection accuracy, model size and inference latency, and to build a lightweight detection model that adapts to the resource constraints of vehicle ECUs; 4. Based on the rarely studied real-world ROAD dataset, it achieves accurate multi-classification of attacks, with core detection performance superior to existing models and reliable generalization ability, providing support for engineering applications.

[0016] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0017] Figure 1 This is an overall framework diagram of the lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm of the present invention; Figure 2 This is a structural diagram of the deep RBM of the lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm of the present invention; Figure 3 This is a flowchart of the AE-NSDBO algorithm of the lightweight vehicle network intrusion detection system based on multi-objective optimization algorithm of the present invention. Detailed Implementation

[0018] In the description of this invention, it should be noted that the terms "upper," "lower," "inner," "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship in which the product of this invention is usually placed when in use. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting this invention.

[0019] Example like Figures 1-3 As shown, the lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm of the present invention includes a data preprocessing module, a two-dimensional feature engineering module, a data augmentation module, and a multi-objective optimization algorithm module. The data preprocessing module is based on the original CAN bus dataset and performs data standardization processing. It mainly completes the conversion of timestamps into time intervals, the conversion of hexadecimal message data into binary data, standardizes the data format, and cleans up the original noise. This achieves the unification of the timing and content data format of the original CAN bus data messages, providing a regular raw data foundation for feature extraction. The specific tasks of the data preprocessing module are as follows: The raw CAN bus data is cleaned, including handling missing values ​​(deleting unparseable message lines) and standardizing data length (padding data fields shorter than 8 bytes with 0x00 from the right to 8 bytes). After cleaning, the timestamp of each message is parsed and extracted. Arbitration Identifier (ID), Data Length (DLC), and Data Payload (Data) are used as the basic fields.

[0020] The dual-dimensional feature engineering module constructs two types of core features based on preprocessed CAN bus data: identifier counting features and identifier data association features; it mines the frequency of occurrence of CAN message IDs and the association patterns between IDs and corresponding data, extracts effective features that can characterize abnormal behavior of the vehicle network, and completes the construction of high-dimensional features for subsequent model training. The two-dimensional feature engineering module introduces two key features: ID Frequency (IDF) and ID-Data Correlation (IDC), as detailed below; The process of calculating ID frequency is as follows: To detect short-term ID frequency anomalies caused by malicious message injection, for the first Each message, its statistics Its timestamp The endpoint is and the length is The number of times it appears within the sliding window is calculated using the following formula: ; The process of calculating ID-Data association is as follows: To quantify the extent of data tampering, the position of each data byte for each ID is preset from clean, normal traffic. Establish a statistical benchmark, mean Standard deviation Normal range is defined as For the message to be tested, calculate the maximum standardized deviation of its data byte values ​​that exceeds the normal range: ; Then, the original timestamp is converted into the time difference between adjacent messages. Each feature value is converted into a binary vector for subsequent processing by the RBM generator. Numerical features are standardized before being input into the classification model. Finally, each message is represented as a unified feature vector. : .

[0021] The data augmentation module uses a sample size analyzer to classify samples into small, medium, and large types. Small samples use KDE smoothing and shallow RBM, medium samples use medium RBM, and large samples combine deep RBM and bit-flipping strategies to generate a synthetic data pool, which solves the problems of scarce attack samples and imbalanced samples in CAN intrusion detection. The data augmentation module uses the HyDRBM-Gen hybrid depth-restricted Boltzmann machine generator, which is based on a deep network of multiple stacked RBMs. The hidden layer nodes of the previous RBM and the visible layer nodes of the next RBM share the same set of units, forming a chain structure of progressive feature abstraction. During training, the model learns multi-level feature representations of data from low-level bit patterns to high-level semantic patterns through layer-by-layer greedy unsupervised pre-training. During generation, random sampling is performed from the top hidden layer and reconstruction is performed layer by layer from top to bottom, finally synthesizing samples that are consistent with the original CAN bus data distribution. This generator is based on fine-grained attack subclasses and adaptively selects the generation strategy according to its sample size. It generates data separately and then merges them to build a more balanced dataset. Since different sample sizes have fundamentally different requirements for the generation model: too few samples can easily lead to overfitting, while when the samples are sufficient, shallow models are difficult to capture complex distributions. Using a uniform strategy cannot achieve ideal results at all scales. The sample size of different attack types in the original CAN bus dataset is statistically analyzed, and the samples are labeled as small, medium, and large based on their size. The corresponding generation path is then dynamically selected. For attack types with very few samples, shallow stacked RBN models are directly trained. To avoid overfitting, kernel density estimation (KDE) is first used for oversampling, and then the shallow structure is used for generation. For medium-depth samples, a medium-depth RBM is directly used for learning and generation; For large samples, a deeper network structure is used for modeling, and tiny random binary perturbations are introduced during the generation process to enhance the diversity of the samples; This generator is capable of generating large-scale data that conforms to the original distribution characteristics when the number of original attack samples ranges from tens to thousands, thus providing a balanced and high-quality training foundation for subsequent intrusion detection models; its pseudocode is shown in Table 1.

[0022] Table 1. Algorithm for generating layered attack data;

[0023] The multi-objective optimization algorithm module uses the XGBoost intrusion detection model as the basis and optimizes its core hyperparameters. It adopts the improved multi-objective algorithm AE-NSDBO, which takes into account the three major indicators of F1 score, model size and inference latency. It is combined with dynamic weight adjustment, adaptive stage detection and hybrid mutation strategy, and selects the optimal hyperparameter combination that balances accuracy, lightweight and low latency through Pareto front screening. The construction process of the multi-objective optimization algorithm module is as follows: S1. The XGBoost hyperparameter optimization problem is constructed into a multi-objective optimization problem model; The XGBoost hyperparameter optimization problem is constructed as a multi-objective optimization problem, collaboratively optimizing detection performance, model size, and inference efficiency. This problem can be formalized as the following three-objective minimization problem: ; ; in, Let be the decision variable vector, representing a set of hyperparameters of XGBoost; The decision space is defined by the range of values ​​for each hyperparameter. Let the target vector be the decision space, and map it to the target space. ， , , These represent model size, negative F1 score (negated to transform it into a minimization problem), and sample inference delay, respectively. The smaller the values ​​of all three, the better. Since the three objectives conflict with each other, there is no single solution that makes all objectives optimal at the same time. Therefore, it is necessary to find a Pareto optimal solution set, that is, a set of solutions that cannot improve other objectives without compromising any one objective. Finally, the algorithm selects a balanced solution from this solution set as the optimal hyperparameter combination based on the weighted objective function value. S2. Combining the non-dominated sorting mechanism with DBO, the coverage of solutions is expanded through the efficient search capability of DBO, and balanced solutions are screened with the help of the non-dominated sorting mechanism, forming an adaptive enhanced non-dominated sorting dung beetle optimization algorithm AE-NSDBO framework that adapts to the needs of multi-objective optimization and optimizes the hyperparameters of XGBoost. The specific process of the adaptively enhanced non-dominated sorting dung beetle optimization algorithm AE-NSDBO is as follows: S21. Randomly generate within the decision space. An initial population of individuals is formed, with each individual representing a set of XGBoost hyperparameters to be optimized. Simultaneously, a Pareto front archive, independent of the population, is initialized to store non-dominated solutions discovered during algorithm execution. Baseline weight vectors for the three objectives are defined. The baseline weights reflect the initial preferences for the three objectives and are used to balance the different effects of their different dimensions. The current weights are initialized as the baseline weights. S22. During the optimization process, the weights are updated based on the distribution of solutions in the current Pareto front, and the standard deviation of each objective value in the front is calculated. The smaller the standard deviation, the more concentrated the solution distribution on the objective, requiring greater weighting to promote exploration. Temporary weights are calculated based on the baseline weights. : ; This design ensures that each weight adjustment is anchored to the initial preference and corrected based on the distribution of the current solution, thus avoiding excessive weight drift. Subsequently, the temporary weights are pruned and normalized to obtain a new weight vector for subsequent generations. ; S23. Optimize XGBoost hyperparameters by selecting parent individuals, adaptive stage detection, introducing a hybrid mutation strategy, evaluating individuals and updating the population. S231. Select parent individuals, calculate the weighted target vector for each individual based on the current weight, perform non-dominated sorting in the weighted target space, and use a binary tournament selection method, prioritizing individuals with lower non-dominated layers and higher crowding in the same layer. Repeat. This constitutes the parent population; S232, Calculating population diversity (Average Euclidean distance between individuals) and convergence rate (The rate of change of the hypervolume of the Pareto front between two adjacent generations), according to and The search is divided into exploration, balancing and development phases, and corresponding dung beetle behaviors are selected for parent individuals to generate initial offspring; The specific content of the exploration, balancing, and development phases is as follows: Exploration Phase: Employing rolling ball behavior, the system moves towards a random Pareto solution and introduces random perturbations. ; in, for, for, For random directions, These are guide individuals randomly selected from the current Pareto frontier. For adaptive attenuation of noise intensity ( Take 0.2), For a standard normally distributed random vector, This represents the current iteration number; Equilibrium Phase: Employing reproductive behavior to move towards elite solutions, with the step size decreasing with each iteration. ; ; in, The elite individuals are randomly selected from the current set of non-dominated optimal solutions, with a step size of [missing information]. The perturbation decreases adaptively with each iteration, ensuring that the initial perturbation is relatively large and gradually refined in later stages. This represents the maximum number of iterations. Development phase: Employing foraging behavior in a random dimension Perform boundary perturbation: ; in, , , This dimension serves as the boundary, while the other dimensions remain unchanged. The perturbation amplitude factor ensures that the search unit is in the optimal neighborhood; S233. To enhance the ability to escape local optima, a hybrid mutation strategy is introduced. For the initial offspring individuals, mutation operations are performed with different probabilities according to the current stage. In the exploration stage, polynomial mutation is used with a higher probability to achieve large-scale jumps. In the equilibrium stage, polynomial mutation, Gaussian mutation and Cauchy mutation are used in combination. In the development stage, small-step Gaussian mutation is the main method. After the mutation is completed, a complete offspring population is obtained. S234. Evaluate individuals and update the population. Train the XGBoost model based on the hyperparameter configuration of offspring individuals, and calculate the original target value and weighted target value. Merge the parent and offspring generations, perform non-dominated sorting and crowding calculation in the weighted target space, and select the new generation of population according to the principle of low non-dominated layer number and high crowding in the same layer. At the same time, extract the non-dominated solution based on the original target value from the merged population to update the Pareto front archive, and control the archive size to maintain diversity. S235. If the preset number of iterations has not been reached, return to S22 and retrain until the preset number of iterations is reached; S24. Select the solution that minimizes the final weighted objective value as the optimal hyperparameter combination; The optimal hyperparameter combination is selected from the final Pareto front, which minimizes the final weighted objective value. ; in, The final weights represent the optimal balance of the three objectives, and this solution is output as the optimal solution.

[0024] AE-NSDBO deeply embeds these three core mechanisms into the iterative optimization process, working synergistically with population evolution to effectively balance the multiple constraints in the optimization of the intrusion detection model; the pseudocode of the algorithm is shown in Table 2 below.

[0025] Table 2. Pseudocode for the AE-NSDBO algorithm; Specific implementation examples: Experimental setup: XGBoost was used as the base classifier, and the AE-NSDBO algorithm was used for hyperparameter optimization. The population size was set to 20 and the number of iterations was 30. Experimental environment: The model in this embodiment is implemented in programming software, using the PyTorch deep learning framework, and implemented through a computer operating system; Original CAN bus dataset: This study primarily uses the ROAD dataset for model performance evaluation. This dataset originates from real, undisclosed vehicles driven by a dynamometer at Oak Ridge National Laboratory (ORNL) during a 3.5-hour event, reproducing various benign driving behaviors and collecting both normal and attack data. It contains more than 12 fine-grained attack categories, which can be mainly categorized into three types based on their mechanisms and characteristics: fuzzy attacks, target ID forgery attacks, and spoofing attacks. In addition, the dataset includes an extra attack called "accelerator attack," but due to the severity of this vulnerability, the authors did not disclose its labeling information, and therefore it was not included in the detection scope of this study. To construct a classification task that is closer to actual detection needs and more generalizable, we use these labeled attack categories and normal traffic together as the training and evaluation objects of the model. The specific data distribution is shown in Table 3. Table 3 ROAD dataset;

[0027] To test the model's generalization ability under different vehicle environments, the experiment was further tested on two benchmark datasets from the Hacking and Countermeasure Research Lab (HCRL). The first is the Car-Hacking dataset, which is collected from modern vehicles and mainly includes basic attack types such as denial-of-service (DoS), fuzzing, and spoofing. Due to its relatively simple attack patterns and sufficient data, it is widely used as an evaluation benchmark in academia. The second is the Survival Analysis dataset, also provided by HCRL. Its feature is that the attack data is collected from three different models: Hyundai Sonata, Kia Soul, and Chevrolet Spark. It mainly involves denial-of-service, fuzzing, and fault attacks, providing a basis for evaluating the model's adaptability across vehicle platforms. These two datasets effectively complement and compare with the ROAD dataset in terms of attack complexity, data scale, and vehicle platforms, providing a multi-dimensional benchmark for comprehensively verifying the model's performance. The detailed data composition of the two datasets is shown in Tables 4 and 5.

[0028] Table 4 Car-hacking dataset;

[0029] Table 5 Survival analysis dataset;

[0030] To ensure the reliability and generalization ability of the optimization evaluation, the data partitioning adopts a five-fold stratified cross-validation (StratifiedKFold) strategy: first, all data is divided into 80% training set and 20% independent test set; the training and validation sets are further split into training set and validation set in an 8:2 ratio. All partitions are stratified sampling on the attack subclass labels to ensure that the distribution ratio of the original attack categories is maintained in each fold of data, providing a stable and balanced evaluation basis for multi-target optimization. Evaluation metrics: To systematically evaluate the overall performance of the model, this study uses multi-dimensional metrics for analysis. All classification performance metrics are calculated based on the confusion matrix, covering true positives (TP), true negatives (TN), false positives (FP), and false negatives (FN). The core classification metrics are defined as follows: accuracy The proportion of samples correctly classified by the model as a whole; ; Accuracy The proportion of samples that the model identifies as attacks is actually attacks, which measures the confidence level and false positive level of the prediction results. ; Recall rate The proportion of all real attack samples successfully detected by the model, also known as the attack detection rate, directly reflects the model's ability to cover security threats. ; F1 score: The harmonic mean of precision and recall, providing a balanced overall evaluation for imbalanced data; ; To evaluate the feasibility of deploying the model in resource-constrained in-vehicle environments, this paper uses both model size and average inference latency per message as key efficiency metrics, as these directly determine the model's storage footprint and real-time processing capabilities. Furthermore, given that this embodiment employs generative adversarial networks for data augmentation, the following quantitative metrics are introduced to quantify the effectiveness of the synthesized attack data: Cosine similarity: Calculates the average cosine similarity between generated data and real data in the feature space, and measures the similarity of the overall distribution trend; KL (Kullback-Leibler Divergence): Measures the information difference between the generated data distribution and the real data distribution. The lower the value, the closer the probability distribution is. Silhouette coefficient: assesses the degree to which generated data points integrate into the original real data cluster structure, and is used to measure the consistency of the data structure.

[0031] To verify the overall performance of MOO-IDS, a systematic evaluation of the proposed MOO-IDS model and several state-of-the-art (SOTA) models was conducted through comparative experiments with other models, focusing on both detection accuracy and model efficiency, as shown in Table 6.

[0032] Table 6. Performance comparison of different models on the ROAD dataset;

[0033] In terms of detection accuracy, MOO-IDS achieved results similar to the best-performing models on multiple metrics. Specifically, in fuzzing attack detection, this application achieved a classification performance score of 1.0000, comparable to MetaCAN and XGBoost. For more complex target ID spoofing attacks, this application achieved an F1-Score of 0.9678, which is only slightly different from the optimized baseline XGBoost (0.9926) and higher than models such as CNN (0.9416) and HyDL-IDS (0.5968). In spoofing attack detection, this application achieved an accuracy of 0.9912, demonstrating a low false positive rate.

[0034] However, the main advantage of this application lies in its significant improvement in model efficiency, which is intuitively demonstrated by the comparison with the baseline model XGBoost: in target ID forgery and spoofing attacks, the difference in F1-Score between the two is less than 0.03, but the model size of this application (0.199 MB) is only 19.4% of that of the XGBoost model (1.026 MB), while the inference latency is reduced by 26.9%; this result confirms that the introduced optimization algorithm can significantly compress the model and improve the inference speed with minimal performance loss.

[0035] Compared to other high-performance models, this application also demonstrates a significant efficiency advantage. Compared to the MetaCAN model (1.583 MB), which also performs well in fuzzing attacks, the size of this application's model is only 12.6% of its size. Compared to the lightweight model LightGBM (1.102 MB), the model size is reduced by approximately 82% while maintaining comparable accuracy. Compared to deep learning models with large parameter sets (such as CNN and LSTM), this application achieves the same or even better accuracy while reducing model size by 1 to 3 orders of magnitude and increasing inference speed by more than 2 orders of magnitude.

[0036] Therefore, the present invention adopts the lightweight vehicle network intrusion detection system based on the multi-objective optimization algorithm described above. By balancing the data distribution of synthetic samples and implementing dual-dimensional feature enhancement to strengthen attack characterization, the detection performance and deployment feasibility are synergistically improved.

[0037] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm, characterized in that, It includes a data preprocessing module, a two-dimensional feature engineering module, a data augmentation module, and a multi-objective optimization algorithm module; The data preprocessing module is based on the original CAN bus dataset and performs data standardization processing. It mainly completes the conversion of timestamps into time intervals, the conversion of hexadecimal message data into binary data, standardizes the data format, and cleans up the original noise, so as to achieve the unification of the timing and content data format of CAN bus data messages. The dual-dimensional feature engineering module constructs two types of core features based on the preprocessed CAN bus data: identifier counting features and identifier data association features. By mining the frequency of CAN message IDs and the correlation between IDs and corresponding data, effective features that can characterize abnormal behavior of vehicle networks are extracted, and high-dimensional features are constructed. The data augmentation module uses a sample size analyzer to classify samples into small, medium, and large types. Small samples are smoothed using KDE and shallow RBM, medium samples use medium RBM, and large samples combine deep RBM and bit-flipping strategies to generate a synthetic data pool. The multi-objective optimization algorithm module uses the XGBoost intrusion detection model as its base and optimizes its core hyperparameters. It adopts the improved multi-objective algorithm AE-NSDBO, which takes into account the three major indicators of F1 score, model size and inference latency. It is combined with dynamic weight adjustment, adaptive stage detection and hybrid mutation strategy, and selects the optimal hyperparameter combination that balances accuracy, lightweight and low latency through Pareto front screening.

2. The lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm according to claim 1, characterized in that: The specific tasks of the data preprocessing module are as follows: The raw CAN bus data is cleaned, including handling missing values ​​and standardizing data length. After cleaning, the timestamp of each message is parsed and extracted. Arbitration Identifier (ID), Data Length (DLC), and Data Payload (Data) are used as the basic fields.

3. The lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm according to claim 2, characterized in that: The two-dimensional feature engineering module introduces two key features: ID frequency and ID-Data correlation, as detailed below; The process of calculating ID frequency is as follows: To detect short-term ID frequency anomalies caused by malicious message injection, for the first Each message, its statistics Its timestamp The endpoint is and the length is The number of times it appears within the sliding window is calculated using the following formula: ； The process of calculating ID-Data association is as follows: To quantify the extent of data tampering, the position of each data byte for each ID is preset from clean, normal traffic. Establish a statistical benchmark, mean Standard deviation Normal range is defined as For the message to be tested, calculate the maximum standardized deviation of its data byte values ​​that exceeds the normal range: ； Then, the original timestamp is converted into the time difference between adjacent messages. Each feature value is converted into a binary vector for subsequent processing by the RBM generator. Meanwhile, numerical features need to be standardized when input into the classification model. Ultimately, each message is represented as a unified feature vector. : 。 4. The lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm according to claim 3, characterized in that: The data augmentation module uses the HyDRBM-Gen hybrid depth-restricted Boltzmann machine generator, which is based on a deep network of multiple stacked RBMs. The hidden layer nodes of the previous RBM and the visible layer nodes of the next RBM share the same set of units, forming a chain structure of feature abstraction layer by layer. During training, the model learns multi-level feature representations of the data from low-level bit patterns to high-level semantic patterns through layer-by-layer greedy unsupervised pre-training. During generation, random samples are taken from the top hidden layer and reconstructed layer by layer from top to bottom, and finally a sample with the same distribution as the original CAN bus data is synthesized. The sample size of different attack types in the original CAN bus dataset is statistically analyzed, and the samples are labeled as small, medium, and large based on their size. The corresponding generation path is then dynamically selected. For attack types with very few samples, shallow stacked RBN models are directly trained. To avoid overfitting, kernel density estimation is used to oversample the model before using the shallow structure to generate the model. For medium-depth samples, a medium-depth RBM is directly used for learning and generation; For large samples, a deeper network structure is used for modeling, and tiny random binary perturbations are introduced during the generation process.

5. The lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm according to claim 4, characterized in that: The construction process of the multi-objective optimization algorithm module is as follows: S1. The XGBoost hyperparameter optimization problem is constructed into a multi-objective optimization problem model; S2. By combining the non-dominated sorting mechanism with DBO, the coverage of solutions is expanded through the efficient search capability of DBO, and balanced solutions are selected by using the non-dominated sorting mechanism. This forms an adaptive and enhanced non-dominated sorting dung beetle optimization algorithm AE-NSDBO framework that adapts to the needs of multi-objective optimization and optimizes the hyperparameters of XGBoost.

6. The lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm according to claim 5, characterized in that: The specific process of S1 is as follows: The XGBoost hyperparameter optimization problem is constructed as a multi-objective optimization problem, collaboratively optimizing detection performance, model size, and inference efficiency. This problem can be formalized as the following three-objective minimization problem: ； ； in, Let be the decision variable vector, representing a set of hyperparameters of XGBoost; The decision space is defined by the range of values ​​for each hyperparameter. Let the target vector be the decision space, and map it to the target space. ， , , These represent model size, negative F1 score, and sample inference delay, respectively; all three values ​​should be as small as possible.

7. The lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm according to claim 6, characterized in that: The specific process of the adaptively enhanced non-dominated sorting dung beetle optimization algorithm AE-NSDBO in S2 is as follows: S21. Randomly generate within the decision space. An initial population of individuals is formed, with each individual representing a set of XGBoost hyperparameters to be optimized. Simultaneously, a Pareto front archive, independent of the population, is initialized to store non-dominated solutions discovered during algorithm execution. Baseline weight vectors for the three objectives are defined. The baseline weights reflect the initial preferences for the three objectives and are used to balance the different effects of their different dimensions. The current weights are initialized as the baseline weights. S22. During the optimization process, the weights are updated based on the distribution of solutions in the current Pareto front, and the standard deviation of each objective value in the front is calculated. The smaller the standard deviation, the more concentrated the solution distribution on the objective, requiring greater weighting to promote exploration. Temporary weights are calculated based on the baseline weights. : ； S23. Optimize XGBoost hyperparameters by selecting parent individuals, adaptive stage detection, introducing a hybrid mutation strategy, evaluating individuals and updating the population. S24. Select the solution that minimizes the final weighted objective value as the optimal hyperparameter combination.

8. The lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm according to claim 7, characterized in that: The specific process of S23 is as follows: S231. Select parent individuals, calculate the weighted target vector for each individual based on the current weight, perform non-dominated sorting in the weighted target space, and use a binary tournament selection method, prioritizing individuals with lower non-dominated layers and higher crowding in the same layer. Repeat. This constitutes the parent population; S232, Calculating population diversity With convergence speed ,according to and The search is divided into exploration, balancing and development phases, and corresponding dung beetle behaviors are selected for parent individuals to generate initial offspring; S233. Introduce a hybrid mutation strategy. For the initial offspring individuals, perform mutation operations with different probabilities according to the current stage. In the exploration stage, use polynomial mutation with a higher probability to achieve large-scale jumps. In the equilibrium stage, use a mixture of polynomial mutation, Gaussian mutation and Cauchy mutation. In the development stage, use small-step Gaussian mutation as the main method. After the mutation is completed, a complete offspring population is obtained. S234. Evaluate individuals and update the population. Train the XGBoost model based on the hyperparameter configuration of offspring individuals, and calculate the original target value and weighted target value. Merge the parent and offspring generations, perform non-dominated sorting and crowding calculation in the weighted target space, and select the new generation of population according to the principle of low non-dominated layer and high crowding in the same layer. At the same time, extract the non-dominated solution based on the original target value from the merged population to update the Pareto front archive, and control the archive size to maintain diversity. S235. If the preset number of iterations has not been reached, return to S22 and retrain until the preset number of iterations is reached.

9. The lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm according to claim 8, characterized in that: The specific details of the exploration, balancing, and development phases in S232 are as follows: Exploration Phase: Employing rolling ball behavior, the system moves towards a random Pareto solution and introduces random perturbations. ； in, for, for, For random directions, These are guide individuals randomly selected from the current Pareto frontier. For adaptive attenuation of noise intensity ( Take 0.2), For a standard normally distributed random vector, This represents the current iteration number; Equilibrium Phase: Employing reproductive behavior to move towards elite solutions, with the step size decreasing with each iteration. ； ； in, The elite individuals are randomly selected from the current set of non-dominated optimal solutions, with a step size of [missing information]. The perturbation decreases adaptively with each iteration, ensuring that the initial perturbation is relatively large and gradually refined in later stages. This represents the maximum number of iterations. Development phase: Employing foraging behavior in a random dimension Perform boundary perturbation: ； in, , , This dimension serves as the boundary, while the other dimensions remain unchanged. The perturbation amplitude factor is used to ensure that the search unit is in the optimal neighborhood.

10. The lightweight vehicle network intrusion detection system based on a multi-objective optimization algorithm according to claim 9, characterized in that: The specific calculation process for S24 is as follows: The optimal hyperparameter combination is selected from the final Pareto front, which minimizes the final weighted objective value. ； in, The final weights represent the optimal balance of the three objectives, and this solution is output as the optimal solution.

Images