Can bus anomaly detection method and system based on dual attention mechanism

Abstract

The present invention relates to a CAN bus anomaly detection method and system based on a dual attention mechanism, comprising the following steps: S1, collecting on-board data from an OBD interface of a vehicle in real time, wherein the collected on-board data comprises operation parameters of an engine, a vehicle speed, the state of a braking system, and the readings of other important sensors; and S2, performing inference analysis on the on-board data at a vehicle end by using an anomaly detection model, calculating a threshold by means of normal operation data so as to identify a potential anomaly or attack mode, once an anomaly is detected, immediately generating identification information, giving a direct alarm to a driver, and slicing, encrypting and storing abnormal data. The present invention relates to the technical field of CAN bus anomaly detection. In the present invention, an anomaly is detected by using the strong relevance of normal data characterization under different perspectives and the difference between the normal data characterization and abnormal data characterization, and by means of the characterization learning of a large amount of normal data, the objective of anomaly detection is achieved, the dependence on abnormal data is reduced, and the accuracy of CAN bus anomaly detection is improved.

Description

A CAN bus anomaly detection method and system based on dual attention mechanism Technical Field

[0001] This invention relates to the technical field of CAN bus anomaly detection, and in particular to a CAN bus anomaly detection method and system based on a dual attention mechanism. Background Technology

[0002] Automotive CAN bus is a serial communication protocol specifically designed for in-vehicle communication. It allows efficient communication between multiple microcontrollers and devices within a vehicle without complex point-to-point wiring harnesses, significantly reducing the number and complexity of wires. By enabling distributed control and real-time data sharing, it improves system integration and reliability, becoming an important component of modern automotive electronic architecture. Using the CAN bus, various sensors, actuators, and control units can work collaboratively, thereby more easily acquiring data from various automotive components for anomaly detection and effective vehicle safety management.

[0003] Existing fault analysis methods based on the CAN bus are mainly post-event analyses, mostly applied to vehicle maintenance scenarios, lacking real-time anomaly detection and alarm capabilities, and unable to provide timely assistance to users while they are driving. Especially with the increasing prevalence of intelligent driving vehicles and the rise of the Internet of Vehicles (IoV) environment, the risk of external attacks has increased dramatically, necessitating practical real-time protection solutions.

[0004] In real-world vehicle driving environments, abnormal data collected by the CAN bus constitutes only a small portion of all data. This results in a large amount of normal data forming the training set, while abnormal data is extremely scarce. Although there are methods for manually injecting abnormal datasets, their application in real-world vehicle environments is subject to many limitations. Manually injected abnormal datasets tend to exhibit strong regularity, making it difficult to comprehensively simulate abnormal situations in real-world scenarios. Therefore, in current research on vehicle CAN bus anomaly detection, obtaining abnormal data is relatively difficult, reducing the accuracy of CAN bus anomaly detection. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the present invention aims to provide a CAN bus anomaly detection method and system based on a dual attention mechanism, thereby resolving the aforementioned technical problems.

[0006] The above-mentioned technical objective of the present invention is achieved through the following technical solution:

[0007] A CAN bus anomaly detection method based on a dual attention mechanism includes the following steps:

[0008] S1. Real-time collection of vehicle data from the vehicle's OBD interface. The collected vehicle data includes engine operating parameters, vehicle speed, braking system status, and readings from other important sensors.

[0009] S2. On-board data is analyzed and reasoned using an anomaly detection model at the vehicle end. Thresholds are calculated using normally operating data to identify potential anomalies or attack patterns. Once an anomaly is detected, identification information is immediately generated, and the driver is alerted directly. The abnormal data is then sliced ​​and stored in an encrypted manner.

[0010] S3. Optimize the anomaly detection model using vehicle data and upload the optimized anomaly detection model to the cloud server;

[0011] S4. The cloud server receives optimized anomaly detection models from different vehicles and fuses them using federated learning. The fused anomaly detection models are then periodically distributed to the vehicles to complete system updates.

[0012] In a preferred embodiment, the present invention can be further configured as follows: the vehicle-mounted data is analyzed using an anomaly detection model on the vehicle side, which is an unsupervised anomaly detection method based on a dual attention mechanism to analyze the uploaded data, specifically including:

[0013] S21, Patching, and normalized CAN bus normal data;

[0014] S22. Feature modeling is performed through two parallel branches: Patch-piece and In-Patch, with a multi-head attention mechanism introduced in each branch.

[0015] S23. By adding upsampling, the representation outputs of different branches are restored to the same dimension;

[0016] S24. A loss function based on the maximum mean difference is used to measure the similarity between two representations;

[0017] S25. Output the abnormal score and perform anomaly detection.

[0018] In a preferred embodiment, the present invention can be further configured such that the specific method of step S21 is as follows:

[0019] Based on the reason that the CAN bus anomaly detection task sensor data synchronization timing has multiple input features, it is divided into a multivariate time series. The input features between different sensor data first undergo channel-independent patching operations, where each channel is data from a single sensor and each channel shares the same self-attention mechanism. The patching processing result is output for step S22.

[0020] In the CAN bus anomaly detection task, the input multivariate time series is: χ∈R T×d

[0021] d represents the number of sensors;

[0022] Single-sensor data, i.e., a single time-series data point, is extracted and processed through a self-attention mechanism, with each channel sharing a self-attention network. The representation result is shown as: χ i ′∈R N×1 i = (1, 2, ..., d)

[0023] Finally, the features are concatenated and used as input for step S22.

[0024] In a preferred embodiment, the present invention can be further configured such that the two parallel branches of step S22 are Patch-piece and In-Patch, respectively;

[0025] Patch-piece focuses on the connections between sensors at different time slices, with each time slice being a unit, and the intrinsic relationships between time slices are modeled by a multi-head self-attention network;

[0026] The In-Patch branch focuses on the connections between sensors within a time slice, and is also modeled using a multi-head self-attention network.

[0027] Based on the joint representation of the two different branches, Patch-piece and In-Patch, the sensor data in the CAN bus anomaly detection problem is represented from a dual perspective to the greatest extent possible. The shared weight method is used to maximize the acquisition of local semantic information of the sensor from different perspectives.

[0028] In a preferred embodiment, the present invention can be further configured as follows: the patch-piece focuses on the connection between sensors at different time segments, the size of different patches is defined as P, and each piece is converted into an embedding vector with an embedding dimension of d. model Multi-head attention weights are used to calculate the representation of different partitions, and the query and key Q,K are initialized: Q Ni ,K Ni =W Qi χ Ni W Ki χ Ni

[0029] Where 1≤i≤H, and H is the number of heads in the multi-head attention mechanism;

[0030] Q Ni ,K Ni The dimensions representing queries and keys, and their learnable parameter matrix, are shown below:

[0031] The attention weights can then be expressed as the formula:

[0032] Finally, we concatenate the attention weights of different slices to obtain Attn. N :

[0033] in, It is a learnable parameter matrix.

[0034] In a preferred embodiment, the invention can be further configured such that the In-Patch branch focuses on the connections between sensors within a time slice, first initializing the query and keys Q,K: Q Pi ,K Pi =W Qi χ Pi W Ki χ Pi

[0035] The dimensions of the query and the key are:

[0036] The dimension of the learnable parameter matrix is ​​defined as:

[0037] The formula for calculating attention weights is defined as follows:

[0038] By concatenating the weights of different nodes, Attn can be obtained. P :

[0039] Patch-pieces and in-patch share weights, with a shared weight of W. Qi W Ki .

[0040] In a preferred embodiment, the present invention can be further configured such that the specific method of step S23 is as follows:

[0041] For a Patch-piece, repeated upsampling within the patch yields the final Patch-piece representation N;

[0042] For In-Patch, upsampling is repeatedly performed from single sensor data to sensor data within the complete patch to finally obtain the In-Patch characterization P.

[0043] In a preferred embodiment, the present invention can be further configured such that the specific method of step S24 is as follows:

[0044] For the patch-piece time slice representation N and the in-patch sensor node representation P, the MMD loss function is defined as follows:

[0045] Γ P {P,N;χ}=∑MMD(P,Stopgrad(N))+MMD(Stopgrad(N),P)

[0046] Γ N {P,N;χ}=∑MMD(N,Stopgrad(P))+MMD(Stopgrad(P),N)

[0047] Where MMD is the maximum mean difference function, the Stopgrad operation is used to prevent the gradient from propagating backward at a specific position to ensure that some parameters remain unchanged, and finally, the total loss Γ of this model is defined by the following formula:

[0048] Using a loss function based on the maximum mean difference to measure the similarity between two representations reduces the distance between normal data and increases the distance between normal data and outlier data.

[0049] A CAN bus anomaly detection system based on a dual attention mechanism includes the aforementioned CAN bus anomaly detection method based on a dual attention mechanism, and also includes a vehicle-side CAN signal acquisition module, a vehicle-mounted data terminal, a CAN signal processing module, a cloud module, and a cloud management module.

[0050] The vehicle-side CAN signal acquisition module reads data from the vehicle's OBD interface in real time. The acquired data includes engine operating parameters, vehicle speed, braking system status, and readings from other important sensors.

[0051] The vehicle-mounted data terminal collects vehicle data from the vehicle-mounted CAN signal acquisition module, and the vehicle-mounted data terminal is connected to the vehicle-mounted CAN signal acquisition module.

[0052] The CAN signal processing module is based on an unsupervised anomaly detection algorithm with a dual attention mechanism. It analyzes the data sent by the vehicle data terminal, provides real-time protection for users, and can optimize the model using the user's current driving data. The optimized model is then uploaded to the cloud module. Both the vehicle data terminal and the cloud module are connected to the CAN signal processing module.

[0053] The cloud module is used to receive anomaly detection models from different vehicles, fuse them using federated learning, and periodically send the fused anomaly detection models to the vehicle-side CAN signal processing module to complete system updates.

[0054] The cloud management module records anomaly and alarm information, provides alarm distribution functions for administrators, and provides data support and interfaces for remote management and operation and maintenance.

[0055] In summary, the present invention has at least one of the following beneficial technical effects:

[0056] 1. This invention proposes a CAN bus anomaly detection method based on a dual attention mechanism. It utilizes the strong correlation between normal data representations and the differences between anomaly data representations from different perspectives to detect anomalies. Through learning from the representations of a large amount of normal data, the model can effectively distinguish between normal and anomaly data, thereby achieving the goal of anomaly detection, reducing dependence on anomaly data, and improving the accuracy of CAN bus anomaly detection.

[0057] 2. Based on the joint representation of two different branches, Patch-piece and In-Patch, this invention can maximize the dual-perspective representation of sensor data in the CAN bus anomaly detection problem. Furthermore, by adopting a shared weight approach, it can maximize the acquisition of local semantic information of the sensor from different perspectives. The invention also introduces an upsampling data processing scheme, which can balance the dataset in the CAN bus anomaly detection field, solve the problem of dataset imbalance, and expand the feature representation in the data, enabling the model to learn data features more comprehensively.

[0058] 3. This invention uses the maximum mean difference (MMD) as the loss function of the model, realizing the core concept of the comparative representation algorithm, namely, reducing the distance between normal data and increasing the distance between normal data and abnormal data, thereby improving the comparison effect. Attached Figure Description

[0059] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0060] Figure 1 is a flowchart of a CAN bus anomaly detection method based on a dual attention mechanism according to the present invention;

[0061] Figure 2 is a flowchart of the unsupervised anomaly detection method using the dual attention mechanism in this invention;

[0062] Figure 3 is a model framework diagram of the unsupervised anomaly detection method with dual attention mechanism in this invention;

[0063] Figure 4 is a schematic diagram of the Patching operation in this invention;

[0064] Figure 5 is a schematic diagram of dual-branch upsampling in this invention;

[0065] Figure 6 is a system diagram of a CAN bus anomaly detection system based on a dual attention mechanism according to the present invention. Detailed Implementation

[0066] The present invention will be further described in detail below with reference to the accompanying drawings.

[0067] Example 1:

[0068] Referring to Figures 1 to 5, the present invention discloses a CAN bus anomaly detection method based on a dual attention mechanism, comprising the following steps:

[0069] S1. Real-time collection of vehicle data from the vehicle's OBD interface. The collected vehicle data includes engine operating parameters, vehicle speed, braking system status, and readings from other important sensors.

[0070] S2. On-board data is analyzed and reasoned using an anomaly detection model at the vehicle end. Thresholds are calculated using normally operating data to identify potential anomalies or attack patterns. Once an anomaly is detected, identification information is immediately generated, and the driver is alerted directly. The abnormal data is then sliced ​​and stored in an encrypted manner.

[0071] S3. Optimize the anomaly detection model using vehicle data and upload the optimized anomaly detection model to the cloud server;

[0072] S4. The cloud server receives optimized anomaly detection models from different vehicles and fuses them using federated learning. The fused anomaly detection models are then periodically distributed to the vehicles to complete system updates.

[0073] Referring to Figures 2 and 3, the vehicle-mounted data is analyzed using an anomaly detection model on the vehicle side. This analysis is based on an unsupervised anomaly detection method with a dual attention mechanism, specifically including:

[0074] S21, Patching, and normalized CAN bus normal data;

[0075] S22. Feature modeling is performed through two parallel branches: Patch-piece and In-Patch, with a multi-head attention mechanism introduced in each branch.

[0076] S23. By adding upsampling, the representation outputs of different branches are restored to the same dimension;

[0077] S24. A loss function based on the maximum mean difference is used to measure the similarity between two representations;

[0078] S25. Output the abnormal score and perform anomaly detection.

[0079] Referring to Figure 4, the specific method of step S21 is as follows:

[0080] Based on the reason that the CAN bus anomaly detection task sensor data synchronization timing has multiple input features, it is divided into a multivariate time series. The input features between different sensor data first undergo channel-independent patching operations, where each channel is data from a single sensor and each channel shares the same self-attention mechanism. The patching processing result is output for step S22.

[0081] In the CAN bus anomaly detection task, the input multivariate time series is: χ∈R T×d

[0082] d represents the number of sensors;

[0083] Single-sensor data, i.e., a single time-series data point, is extracted and processed through a self-attention mechanism, with each channel sharing a self-attention network. The representation result is shown as: χ i ′∈R N×1 i = (1, 2, ..., d)

[0084] Finally, the features are concatenated and used as input for step S22.

[0085] The two parallel branches of step S22 are Patch-piece and In-Patch;

[0086] Patch-piece focuses on the connections between sensors at different time slices, with each time slice being a unit, and the intrinsic relationships between time slices are modeled by a multi-head self-attention network;

[0087] The In-Patch branch focuses on the connections between sensors within a time slice, and is also modeled using a multi-head self-attention network.

[0088] Based on the joint representation of the two different branches, Patch-piece and In-Patch, the sensor data in the CAN bus anomaly detection problem is represented from a dual perspective to the greatest extent possible. The shared weight method is used to maximize the acquisition of local semantic information of the sensor from different perspectives.

[0089] Meanwhile, the output dimensions of the two branches are different. Considering the subsequent calculation of shared weights and to make up for this loophole in the design, this embodiment restores the representation output of different branches to the same dimension by adding upsampling.

[0090] The patch-piece focuses on the connections between sensors at different time segments. The size of each patch is defined as P, and each piece is converted into an embedding vector with an embedding dimension of d. model Multi-head attention weights are used to calculate the representation of different partitions, and the query and key Q,K are initialized: Q Ni ,K Ni =W Qi χ Ni W Ki χ Ni

[0091] Where 1≤i≤H, and H is the number of heads in the multi-head attention mechanism;

[0092] Q Ni ,K Ni The dimensions representing queries and keys, and their learnable parameter matrix, are shown below:

[0093] The attention weights can then be expressed as the formula:

[0094] Finally, we concatenate the attention weights of different slices to obtain Attn. N :

[0095] in, It is a learnable parameter matrix.

[0096] The In-Patch branch focuses on the connections between sensors within a time slice. First, it initializes the query and keys Q, K: Q Pi ,K Pi =W Qi χ Pi W Ki χ Pi

[0097] The dimensions of the query and the key are:

[0098] The dimension of the learnable parameter matrix is ​​defined as:

[0099] The formula for calculating attention weights is defined as follows:

[0100] By concatenating the weights of different nodes, Attn can be obtained. P :

[0101] Patch-pieces and in-patch share weights, with a shared weight of W. QiW Ki .

[0102] Referring to Figure 5, the specific method of step S23 is as follows:

[0103] For a Patch-piece, repeated upsampling within the patch yields the final Patch-piece representation N;

[0104] For In-Patch, upsampling is repeatedly performed from single sensor data to sensor data within the complete patch to finally obtain the In-Patch characterization P.

[0105] This solution can balance the dataset in the field of CAN bus anomaly detection, solving the problem of dataset imbalance; secondly, it can expand the feature representation in the data, enabling the model to learn the data features more comprehensively.

[0106] The contrastive representation learning model proposed in this embodiment represents normal CAN bus data from two branches and different perspectives. In order to realize the core concept of the contrastive representation algorithm, namely, to reduce the distance between normal data and increase the distance between normal data and abnormal data, we use the maximum mean difference (MMD) as the loss function of the model.

[0107] We believe that during the data transmission process of bus sensors, the characteristics of normal sensor data basically meet a fixed threshold, that is, the transmitted data will not change randomly. The changes in the data must follow the normal driving state of the vehicle. A sudden change in the data of a certain normal sensor will inevitably lead to changes in the data of other normal sensors. That is, the data changes are still traceable. The MMD loss function achieves this goal by using the principle of the average value of sample similarity.

[0108] The specific method for step S24 is as follows:

[0109] For the patch-piece time slice representation N and the in-patch sensor node representation P, the MMD loss function is defined as follows:

[0110] Γ P {P,N;χ}=∑MMD(P,Stopgrad(N))+MMD(Stopgrad(N),P)

[0111] Γ N {P,N;χ}=∑MMD(N,Stopgrad(P))+MMD(Stopgrad(P),N)

[0112] Where MMD is the maximum mean difference function, the Stopgrad operation is used to prevent the gradient from propagating backward at a specific position to ensure that some parameters remain unchanged, and finally, the total loss Γ of this model is defined by the following formula:

[0113] Using a loss function based on the maximum mean difference to measure the similarity between two representations reduces the distance between normal data and increases the distance between normal data and outlier data.

[0114] This embodiment proposes a CAN bus anomaly detection method based on a dual attention mechanism. It utilizes the strong correlation between normal data representations and the differences between anomaly data representations from different perspectives to detect anomalies. Through learning from the representations of a large amount of normal data, the model can effectively distinguish between normal and anomaly data, thereby achieving the goal of anomaly detection, reducing dependence on anomaly data, and improving the accuracy of CAN bus anomaly detection.

[0115] Example 2:

[0116] Referring to Figure 6, a CAN bus anomaly detection system based on a dual attention mechanism includes the CAN bus anomaly detection method based on a dual attention mechanism described in Embodiment 1, and further includes a vehicle-side CAN signal acquisition module, a vehicle-mounted data terminal, a CAN signal processing module, a cloud module, and a cloud management module.

[0117] The vehicle-side CAN signal acquisition module reads data from the vehicle's OBD interface in real time. The acquired data includes engine operating parameters, vehicle speed, braking system status, and readings from other important sensors.

[0118] The vehicle-mounted data terminal collects vehicle data from the vehicle-mounted CAN signal acquisition module, and the vehicle-mounted data terminal is connected to the vehicle-mounted CAN signal acquisition module.

[0119] The CAN signal processing module is based on an unsupervised anomaly detection algorithm with a dual attention mechanism. It analyzes the data sent by the vehicle data terminal, provides real-time protection for users, and can optimize the model using the user's current driving data. The optimized model is then uploaded to the cloud module. Both the vehicle data terminal and the cloud module are connected to the CAN signal processing module.

[0120] The cloud module is used to receive anomaly detection models from different vehicles, fuse them using federated learning, and periodically send the fused anomaly detection models to the vehicle-side CAN signal processing module to complete system updates.

[0121] The cloud management module records anomaly and alarm information, provides alarm distribution functions for administrators, and provides data support and interfaces for remote management and operation and maintenance.

[0122] The implementation principle of the above embodiments is as follows:

[0123] S1. Real-time collection of vehicle data from the vehicle's OBD interface. The collected vehicle data includes engine operating parameters, vehicle speed, braking system status, and readings from other important sensors.

[0124] S2. On-board data is analyzed and reasoned using an anomaly detection model at the vehicle end. Thresholds are calculated using normally operating data to identify potential anomalies or attack patterns. Once an anomaly is detected, identification information is immediately generated, and the driver is alerted directly. The abnormal data is then sliced ​​and stored in an encrypted manner.

[0125] S3. Optimize the anomaly detection model using vehicle data and upload the optimized anomaly detection model to the cloud server;

[0126] S4. The cloud server receives optimized anomaly detection models from different vehicles and fuses them using federated learning. The fused anomaly detection models are then periodically distributed to the vehicles to complete system updates.

[0127] The embodiments described herein are preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape, and principle of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A CAN bus anomaly detection method based on a dual attention mechanism, characterized in that: Includes the following steps: S1. Real-time collection of vehicle data from the vehicle's OBD interface. The collected vehicle data includes engine operating parameters, vehicle speed, braking system status, and readings from other important sensors. S2. On-board data is analyzed and reasoned using an anomaly detection model at the vehicle end. Thresholds are calculated using normally operating data to identify potential anomalies or attack patterns. Once an anomaly is detected, identification information is immediately generated, and the driver is alerted directly. The abnormal data is then sliced ​​and stored in an encrypted manner. S3. Optimize the anomaly detection model using vehicle data and upload the optimized anomaly detection model to the cloud server; S4. The cloud server receives optimized anomaly detection models from different vehicles and fuses them using federated learning. The fused anomaly detection models are then periodically distributed to the vehicles to complete system updates.

2. The CAN bus anomaly detection method based on a dual attention mechanism according to claim 1, characterized in that: The vehicle-mounted data is analyzed using an anomaly detection model on the vehicle side. This analysis is based on an unsupervised anomaly detection method with a dual attention mechanism, specifically including: S21, Patching, and normalized CAN bus normal data; S22. Feature modeling is performed through two parallel branches: Patch-piece and In-Patch, with a multi-head attention mechanism introduced in each branch. S23. By adding upsampling, the representation outputs of different branches are restored to the same dimension; S24. A loss function based on the maximum mean difference is used to measure the similarity between two representations; S25. Output the abnormal score and perform anomaly detection.

3. The CAN bus anomaly detection method based on a dual attention mechanism according to claim 2, characterized in that: The specific method for step S21 is as follows: Based on the reason that the CAN bus anomaly detection task sensor data synchronization timing has multiple input features, it is divided into a multivariate time series. The input features between different sensor data first undergo channel-independent patching operations, where each channel is data from a single sensor and each channel shares the same self-attention mechanism. The patching processing result is output for step S22. In the CAN bus anomaly detection task, the input multivariate time series is: χ ∈ R T×d d represents the number of sensors; After extracting data from a single sensor, i.e., a single time series data point, and applying it through a self-attention mechanism, with each channel sharing a self-attention network, the representation results are shown as follows: χ i ′∈R N×1 ,i=(1,2,...,d) Finally, the features are concatenated and used as input for step S22.

4. The CAN bus anomaly detection method based on a dual attention mechanism according to claim 3, characterized in that: The two parallel branches of step S22 are Patch-piece and In-Patch; Patch-piece focuses on the connections between sensors at different time slices, with each time slice being a unit, and the intrinsic relationships between time slices are modeled by a multi-head self-attention network; The In-Patch branch focuses on the connections between sensors within a time slice, and is also modeled using a multi-head self-attention network. Based on the joint representation of the two different branches, Patch-piece and In-Patch, the sensor data in the CAN bus anomaly detection problem is represented from a dual perspective to the greatest extent possible. The shared weight method is used to maximize the acquisition of local semantic information of the sensor from different perspectives.

5. The CAN bus anomaly detection method based on a dual attention mechanism according to claim 4, characterized in that: The patch-piece focuses on the connections between sensors at different time segments. The size of each patch is defined as P, and each piece is converted into an embedding vector with an embedding dimension of d. model Multi-head attention weights are used to calculate the representation of different partitions, and the query and key Q,K are initialized: Q Ni ,K Ni =W Qi χ Ni W Ki χ Ni Where 1≤i≤H, and H is the number of heads in the multi-head attention mechanism; Q Ni ,K Ni The dimensions representing queries and keys, and their learnable parameter matrix, are shown below: The attention weights can then be expressed as the formula: Finally, we concatenate the attention weights of different slices to obtain Attn. N : in, It is a learnable parameter matrix.

6. The CAN bus anomaly detection method based on a dual attention mechanism according to claim 5, characterized in that: The In-Patch branch focuses on the connections between sensors within a time slice. First, it initializes the query and keys Q, K: Q Pi ,K Pi =W Qi χ Pi W Ki χ Pi The dimensions of the query and the key are: The dimension of the learnable parameter matrix is ​​defined as: The formula for calculating attention weights is defined as follows: By concatenating the weights of different nodes, Attn can be obtained. P : Patch-pieces and in-patch share weights, with a shared weight of W. Qi W Ki .

7. The CAN bus anomaly detection method based on a dual attention mechanism according to claim 6, characterized in that: The specific method for step S23 is as follows: For a Patch-piece, repeated upsampling within the patch yields the final Patch-piece representation N. For In-Patch, upsampling is repeatedly performed from single sensor data to sensor data within the complete patch to finally obtain the In-Patch characterization P.

8. The CAN bus anomaly detection method based on a dual attention mechanism according to claim 7, characterized in that: The specific method for step S24 is as follows: For the patch-piece time slice representation N and the in-patch sensor node representation P, the MMD loss function is defined as follows: C P {P,N;x}=∑MMD(P,Stopgrad(N))+MMD(Stopgrad(N),P) C N {P,N;x}=∑MMD(N,Stopgrad(P))+MMD(Stopgrad(P),N) Where MMD is the maximum mean difference function, the Stopgrad operation is used to prevent the gradient from propagating backward at a specific position to ensure that some parameters remain unchanged, and finally, the total loss Γ of this model is defined by the following formula: Using a loss function based on the maximum mean difference to measure the similarity between two representations reduces the distance between normal data and increases the distance between normal data and outlier data.

9. A CAN bus anomaly detection system based on a dual attention mechanism, comprising the CAN bus anomaly detection method based on a dual attention mechanism as described in any one of claims 1 to 8, characterized in that: This includes a vehicle-side CAN signal acquisition module, an on-board data terminal, a CAN signal processing module, a cloud module, and a cloud management module; The vehicle-side CAN signal acquisition module reads data from the vehicle's OBD interface in real time. The acquired data includes engine operating parameters, vehicle speed, braking system status, and readings from other important sensors. The vehicle-mounted data terminal collects vehicle data from the vehicle-mounted CAN signal acquisition module, and the vehicle-mounted data terminal is connected to the vehicle-mounted CAN signal acquisition module. The CAN signal processing module is based on an unsupervised anomaly detection algorithm with a dual attention mechanism. It analyzes the data sent by the vehicle data terminal, provides real-time protection for users, and can optimize the model using the user's current driving data. The optimized model is then uploaded to the cloud module. Both the vehicle data terminal and the cloud module are connected to the CAN signal processing module. The cloud module is used to receive anomaly detection models from different vehicles, fuse them using federated learning, and periodically send the fused anomaly detection models to the vehicle-side CAN signal processing module to complete system updates. The cloud management module records anomaly and alarm information, provides alarm distribution functions for administrators, and provides data support and interfaces for remote management and operation and maintenance.

Images