WO2023078243A1 - 一种车载网络can总线入侵检测方法及*** - Google Patents

一种车载网络can总线入侵检测方法及*** Download PDF

Info

Publication number
WO2023078243A1
WO2023078243A1 PCT/CN2022/128988 CN2022128988W WO2023078243A1 WO 2023078243 A1 WO2023078243 A1 WO 2023078243A1 CN 2022128988 W CN2022128988 W CN 2022128988W WO 2023078243 A1 WO2023078243 A1 WO 2023078243A1
Authority
WO
WIPO (PCT)
Prior art keywords
model
gmm
sequence
hmm
probability
Prior art date
Application number
PCT/CN2022/128988
Other languages
English (en)
French (fr)
Inventor
胡恒
胡红星
成文东
黄惠斌
于涛
刘虹
Original Assignee
中汽创智科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中汽创智科技有限公司 filed Critical 中汽创智科技有限公司
Publication of WO2023078243A1 publication Critical patent/WO2023078243A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/29—Graphical models, e.g. Bayesian networks
    • G06F18/295—Markov models or related models, e.g. semi-Markov models; Markov random fields; Networks embedding Markov models
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N7/00—Computing arrangements based on specific mathematical models
    • G06N7/01—Probabilistic graphical models, e.g. probabilistic networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/40—Bus networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/40—Bus networks
    • H04L2012/40208—Bus networks characterized by the use of a particular bus standard
    • H04L2012/40215—Controller Area Network CAN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/40—Bus networks
    • H04L2012/40267—Bus for use in transportation systems
    • H04L2012/40273—Bus for use in transportation systems the transportation system being a vehicle
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/10—Active monitoring, e.g. heartbeat, ping or trace-route
    • H04L43/106—Active monitoring, e.g. heartbeat, ping or trace-route using time related information in packets, e.g. by adding timestamps
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/50—Testing arrangements
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02T—CLIMATE CHANGE MITIGATION TECHNOLOGIES RELATED TO TRANSPORTATION
    • Y02T10/00—Road transport of goods or passengers
    • Y02T10/10—Internal combustion engine [ICE] based vehicles
    • Y02T10/40—Engine management systems

Definitions

  • the invention relates to the technical field of vehicle intrusion detection, in particular to a vehicle network CAN bus intrusion detection method and system.
  • the object of the invention is to propose a vehicle network CAN bus intrusion detection method, that is, a vehicle network CAN bus intrusion detection method based on GMM-HMM (Gaussian Mixture Model-Hidden Markov Model) .
  • the method uses an unsupervised probability algorithm based on statistics, which can extract the different periods of the message sequence, and give the transition relationship between different periods, that is, the change from the previous period to the next period probability.
  • GMM-HMM Global System for Markov model
  • the method uses an unsupervised probability algorithm based on statistics, which can extract the different periods of the message sequence, and give the transition relationship between different periods, that is, the change from the previous period to the next period probability.
  • the vehicle-mounted network CAN bus intrusion detection method that the present invention proposes its principle is: because CAN bus message has multiple transmission modes such as periodic type, event type, has caused CAN bus message to have different transmission periods, due to the arbitration of CAN bus Mechanism and noise influence cause the inter-frame interval of the message to fluctuate around a certain period. Through statistics, it is found that this fluctuation presents a Gaussian distribution, so the mixed Gaussian model GMM is used to fit this distribution. To restore the defined sending cycle of the message, at this time GMM represents a sending cycle of the message, and each GMM is regarded as a state, and the HMM algorithm is used to count the transition relationship between each state, and each message can be obtained.
  • the transfer relationship between periods, so that the periodic characteristics of the message can be modeled using GMM-HMM.
  • the likelihood probability of a certain periodic sequence can be calculated through the model. If there is a cycle in the sequence that deviates too much from the existing cycle, or there is a transition relationship that should not occur, then the likelihood probability of the periodic sequence will drop significantly. Thereby, its abnormal situation can be judged.
  • the vehicle-mounted network CAN bus intrusion detection method that the present invention proposes comprises the following steps:
  • Step 1 Obtain the CAN bus normal message of the vehicle network
  • the information of the message includes time stamp, CAN ID, data length code DLC, data.
  • Step 2 For each CAN ID, calculate the cycle of all messages of the CAN ID in chronological order, form a cycle sequence, and use it as the algorithm input of GMM-HMM;
  • the cycle of the calculation is the time interval between any consecutive two frame messages of the same CAN ID; the calculation method of the message cycle is the timestamp of the next frame message in the two consecutive frame messages minus the previous frame The difference obtained from the timestamp of the packet.
  • Step 3 For the periodic sequence of each CAN ID, construct and train a GMM-HMM model M id for it, and calculate the minimum likelihood probability score id of the normal sequence of the CAN ID in the model;
  • step 3 The specific steps of step 3 are as follows:
  • Step 3.1 Build the GMM-HMM algorithm model, the model structure is shown in Figure 2, the algorithm model includes one or more GMM models, the GMM model structure is shown in Figure 3, the x-axis is the statistical object, and the y-axis is the statistical Quantity, a GMM model is a combination of several Gaussian distributions, each GMM model is a state of the HMM model, and there is a probability transition relationship between the GMM model and the HMM state.
  • the GMM-HMM model corresponds to the periodic model of CAN ID.
  • a GMM model corresponds to a cycle of CAN ID
  • the GMM model is the HMM state
  • the transition relationship between two HMM states corresponds to the transition relationship between CAN ID message cycles.
  • the periodic sequence used as the input of the GMM-HMM model is called the observation sequence.
  • the observation sequence is randomly generated by the hidden state sequence.
  • the hidden state here refers to the sending cycle defined by the CAN ID message itself, and the message will be received by other bus when it is sent. The impact of messages and the environment, so the actual sending cycle is not necessarily the same as the defined cycle.
  • the GMM-HMM model obtains a possible pre-defined cycle by GMM fitting the observed cycle distribution, and then calculates it through HMM The jump relationship between them, thus modeling the cycle of the CAN ID;
  • the emission probability B is the probability of the hidden state generating the observed value, that is, the probability of defining the cycle to generate the observation cycle, that is, the probability p(x) of the GMM model generating the sample point x
  • the emission probability B is the probability of the hidden state generating the observed value, that is, the probability of defining the cycle to generate the observation cycle, that is, the probability p(x) of the GMM model generating the sample point x
  • Step 3.4 Divide the Cycle id vector into two parts: the training set Train id and the verification set Verify id . It is required that there is no overlap between the training set and the verification set, and the division ratio between the two is set to 9:1 based on experience;
  • Step 3.5 Using the Train id as input, use the Baum-Welch algorithm to train the model parameters of the GMM-HMM model.
  • ⁇ ji refers to the probability that the j-th state in the state transition matrix A is transferred to the i-th state, refers to the observation value generated by the i-th state in the emission probability B The probability.
  • the probability of generating an observation sequence O is:
  • the probability of generating an observation sequence O is:
  • w ⁇ ik ⁇ , ⁇ ik , ⁇ ik are the i-th state, that is, the parameters of the k-th Gaussian component in the i-th GMM model
  • ⁇ tik ⁇ ti r ik is the observed value of the observation sequence at time t belongs to the The probability of the kth Gaussian component of the i state, where is the probability that a sample in the i-th state belongs to the k-th Gaussian component.
  • Step 3.6 According to the trained GMM-HMM model, use the Verify id as input, and use the forward-backward algorithm to calculate the likelihood probability of each periodic sequence sample of length T in the same CAN ID;
  • Step 3.7 The minimum value of the likelihood probability obtained in the previous step is score id .
  • Step 4 Use the trained GMM-HMM model to calculate the likelihood probability of the periodic sequence of each CAN ID in the tested message sequence, and compare it with the score threshold to determine whether the tested message sequence is abnormal.
  • step 4 The specific steps of step 4 are as follows:
  • Step 4.1 For each measured CAN ID, calculate the period of all messages of the CAN ID in chronological order to form a period sequence;
  • Step 4.2 For the periodic sequence of each CAN ID, divide each CAN ID into a vector Test id composed of equal-length periodic sequences of length T, where T is set to 150 based on experience; the length T can be selected when setting It can be consistent with the length set during model training, or it can be inconsistent; when the length is consistent, better detection results can be achieved;
  • Step 4.3 Using the Test id as input, use the forward-backward algorithm to calculate the likelihood probability of each periodic sequence of each CAN ID using the GMM-HMM model corresponding to each CAN ID;
  • Step 4.4 Compare the calculated likelihood probability with the threshold value of score id , if the calculated likelihood probability is less than the threshold value range, it is judged as an abnormal periodic sequence, where the threshold value range is set according to experience as
  • the present invention provides a CAN bus intrusion detection method, which can extract the transfer relationship between different sending cycles and different cycles of the message, so as to be able to insert a message into the CAN bus and cause cycle abnormality
  • a CAN bus intrusion detection method which can extract the transfer relationship between different sending cycles and different cycles of the message, so as to be able to insert a message into the CAN bus and cause cycle abnormality
  • For detection compared with machine learning methods for solving similar problems, it is more interpretable, considers features more comprehensively, trains faster, requires less computing power, and can cope with unknown attack modes.
  • Fig. 1 is a flow chart of the intrusion detection method of the present invention.
  • Fig. 2 is a structure diagram of the GMM-HMM model in the method of the present invention.
  • Fig. 3 is a structural diagram of the GMM model in the method of the present invention.
  • the invention provides a GMM-HMM-based vehicle network CAN bus intrusion detection method, the specific implementation steps are as follows:
  • Step 1 Obtain CAN bus normal messages.
  • Step 2 For each CAN ID, calculate the period of all messages of the CAN ID in chronological order to form a period sequence.
  • Step 3 Construct and train a GMM-HMM model for the periodic sequence of each CAN ID, and calculate the minimum likelihood probability score id of the normal sequence.
  • Step 3.1 Build the GMM-HMM algorithm model, the algorithm model includes one or more GMM models, each GMM model is a state of the HMM model, and there is a probability transition relationship between the states of the HMM model.
  • Step 3.4 Divide the Cycle id vector into two parts: the training set Train id and the verification set Verify id .
  • Step 3.5 Take the Train id as input, and use the python hmmlearn library to train the model parameters of the GMM-HMM model.
  • Step 3.6 According to the trained GMM-HMM model, the Verify id is used as input, and the likelihood probability of each period sequence sample is calculated with the help of python hmmlearn library.
  • Step 3.7 The minimum value of the likelihood probability obtained in the previous step is score id .
  • Step 4 Use the trained GMM-HMM model to calculate the likelihood probability of the periodic sequence of each CAN ID in the tested message sequence, and compare it with the score threshold to determine whether the tested message sequence is abnormal.
  • Step 4.1 For each CAN ID to be tested, calculate the period of all messages of the CAN ID in chronological order to form a period sequence.
  • Step 4.3 Take the Test id as input, and use the python hmmlearn library to calculate the likelihood probability of each period sequence generated by each model.
  • Step 4.4 Compare the calculated likelihood probability with the threshold of score id , and set the threshold as If less than the threshold range Then it is judged as an abnormal periodic sequence.
  • CANoe to connect to the OBD interface of the car, collect CAN bus messages for 30 minutes and save them locally, preprocess the collected messages, extract information such as time stamp, CAN ID, DLC and data, and use them as input messages based on this method.
  • Train the GMM-HMM model of each CAN ID then deploy the model to the CAN bus gateway, monitor the messages on the bus, record the time stamp of each CAN ID and calculate the cycle, save the latest 150 A cycle is the measured cycle sequence.
  • the likelihood probability is calculated by the model to judge whether the cycle sequence is abnormal. If there is an abnormality, a warning will be generated and displayed on the instrument.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Artificial Intelligence (AREA)
  • Evolutionary Computation (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Evolutionary Biology (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computational Mathematics (AREA)
  • Algebra (AREA)
  • Probability & Statistics with Applications (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Pure & Applied Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Software Systems (AREA)
  • Image Analysis (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Small-Scale Networks (AREA)

Abstract

本发明公开了一种车载网络CAN总线入侵检测方法，包括以下步骤：获取车载网络CAN总线正常报文，按时间顺序统计出每个CAN ID所有报文的周期，形成周期序列，作为算法的输入；算法将每个CAN ID的周期序列划分为固定长度，然后为每个CAN ID训练一个GMM-HMM模型，得出正常周期序列的似然概率；对于被测报文序列，同样统计出每个CAN ID的周期序列，输入模型后计算出生成该序列的似然概率，通过比较该似然概率与上一步得到的似然概率的阈值作比较，来判断报文序列是否异常。本发明解决CAN总线报文周期异常检测问题，可以发现DoS、模糊、重放等向总线***报文的攻击行为。

Description

一种车载网络CAN总线入侵检测方法及***
本申请要求于2021年11月2日提交中国专利局、申请号为202111287157.3、发明名称为“一种基于GMM-HMM的车载网络CAN总线入侵检测方法及***”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及车辆入侵检测技术领域，特别是涉及一种车载网络CAN总线入侵检测方法及***。
背景技术
近年来，车联网进入了一个迅速发展的时期。车辆上的车载设备通过无线通信技术连接网络，来获取更加丰富的服务和强大的功能，同时也为网络攻击提供了更多的可能。攻击者可以通过各种手段攻击到车辆电子***，对车载CAN总线发起DoS、模糊、重放、篡改等攻击，将可能严重影响到车辆的行驶安全，威胁到驾驶员和其他交通参与者的人身安全和财产安全。因此，有必要对CAN总线通信状态和内容进行实时监测，并及时报告异常情况，以保障CAN总线的通信安全。
以往针对CAN总线入侵监测的方法，不少是基于深度学习、神经网络的机器学习方法，这类方法的可解释性很差，计算量要求很高，实用性比较弱；针对CAN总线报文周期特征的异常检测方法，往往只关注周期大小本身，而没有考虑不同周期之间的变化关系，导致对于存在多周期的报文的检测准确率下降。
发明内容
为了解决现有技术存在的不足，本发明的目的是提出了一种车载网络CAN总线入侵检测方法，即基于GMM-HMM(高斯混合模型-隐马尔可夫模型)的车载网络CAN总线入侵检测方法。所述方法利用了一种无监督的基于统计学的概率算法，可以提取出报文序列存在的不同周期，并给出不同周期之间的转移关系，即从上一个周期变化为下一个周期的概率。通过计算被测报文序列关于上述周期特征的似然概率，可以判断被测报文序列是否存在异常，可以发现DoS、模糊、重放等向总线***报文的攻击行为。
本发明提出的车载网络CAN总线入侵检测方法，其原理在于：由于CAN总线报文存在周期型、事件型等多种发送方式，导致了CAN总线报文存在不同的发送周期，由于CAN总线的仲裁机制和噪声影响，导致了报文的帧间间隔是围绕某一特定周期而有一定波动的，通过统计发现这种波动呈现出高斯分布的形态，所以使用混合高斯模型GMM拟合这种分布，来还原报文被定义的发送周期，此时GMM就代表了报文的一个发送周期，将每个GMM作为一个状态，使用HMM算法统计每个状态之间的转移关系，就可以得到报文每个周期之间的转移关系，从而可以使用GMM-HMM对报文的周期特征建模。通过模型可以计算产生某一周期序列的似然概率，如果序列中存在偏离既有周期太大的周期，或者出现了不应该出现的转移关系，那么该周期序列的似然概率就会明显下降，从而可以判断其异常情况。
本发明提出的车载网络CAN总线入侵检测方法，包括以下步骤：
步骤1：获取车载网络CAN总线正常报文；
所述报文的信息包括时间戳、CAN ID、数据长度码DLC、数据。
步骤2：对于每个CAN ID，按时间顺序计算出该CAN ID所有报文的周期，形成一个周期序列，作为GMM-HMM的算法输入；
所述计算的周期为相同CAN ID的任意连续两帧报文之间的时间间隔；所述报文周期的计算方法为连续两帧报文中后一帧报文的时间戳减去前一帧报文的时间戳所得的差值。
步骤3：对于每个CAN ID的周期序列，为其构建和训练一个GMM-HMM模型M id，并计算在该模型中，该CAN ID正常序列的最小似然概率score id；
步骤3的具体步骤如下：
步骤3.1：搭建GMM-HMM算法模型，模型结构如图2所示，所述算法模型中包括一个或多个GMM模型，GMM模型结构如图3所示，x轴为统计对象，y轴为统计数量，一个GMM模型是若干高斯分布的组合，每个GMM模型是HMM模型的一个状态，GMM模型即HMM状态两两之间存在概率转移关系，其中GMM-HMM模型对应于CAN ID的周期模型，一个GMM模型对应于CAN ID的一种周期，GMM模型即HMM状态，HMM状态两两之间的转移关系对应于CAN ID报文周期之间的跳变关系。作为GMM-HMM模型输入的周期序列称为观测序列，观测序列由隐藏状态序列随机产生，这里的隐藏状态指该CAN ID报文本身所定义的发送周期，而报文在发送时会受到总线其他报文和环境的影响，所以实际发送的周期也就 是被观测到的周期和定义的不一定一样，GMM-HMM模型通过GMM拟合观测周期分布获得可能的预先定义的周期，然后通过HMM统计出它们之间的跳变关系，从而为该CAN ID的周期建模；
步骤3.2：设定GMM-HMM算法的训练参数，算法迭代轮数c＝10，迭代收敛阈值tol＝0.01，GMM模型即HMM模型状态的个数n＝4，每个GMM模型的高斯成分的个数K＝2，HMM模型状态初始概率π、状态转移概率矩阵A以及每个GMM模型中每个高斯成分的均值μ、方差∑、权重w；并对HMM模型状态初始概率π、状态转移矩阵A以及每个GMM模型中每个高斯成分的均值μ、方差∑、权重w做随机初始化。GMM模型为
Figure PCTCN2022128988-appb-000001
HMM模型为λ＝(π,A,B)，其中发射概率B是隐藏状态生成观测值的概率，也就是定义周期产生观测周期的概率，即GMM模型产生样本点x的概率p(x)；在训练过程中要求算法的训练效果较好，并且速度越快越好；迭代过程中达到设定的迭代轮数或迭代收敛阈值，则迭代结束；在一般的使用场景中，使用默认值，迭代轮数c＝10，迭代收敛阈值tol＝0.01即可；
步骤3.3：对于每个CAN ID的周期序列，分别将其划分为长度为T＝150的周期序列组成的向量Cycle id，其中T可以根据经验进行调整设置；如果T的设置值过小则难以有效提取特征，如果T的设置值过大，则会降低异常周期的影响，都会使检测能力降低；
步骤3.4：将Cycle id向量划分成训练集Train id和验证集Verify id两部分，要求训练集和验证集没有重叠部分，两者的划分比例根据 经验设置为9:1；
步骤3.5：将Train id作为输入，使用Baum-Welch算法训练GMM-HMM模型的模型参数。
设Train id中的观测样本为O＝{o 1,o 2,…,o T}，则{o 1,o 2,…,o t},t≤T且t时刻状态s t为i的概率α ti＝P(o 1,o 2,…,o t,s t＝i)用前向算法计算为：
Figure PCTCN2022128988-appb-000002
Figure PCTCN2022128988-appb-000003
其中α ji是指状态转移矩阵A中第j个状态转移到第i个状态的概率，
Figure PCTCN2022128988-appb-000004
是指发射概率B中第i个状态生成观测值
Figure PCTCN2022128988-appb-000005
的概率。生成观测序列O的概率为：
Figure PCTCN2022128988-appb-000006
t时刻状态st为i且t+1时刻开始的观测序列为{o t+1,o t+2,…,o T}的概率β ti＝P(o t+1,o t+2,…,o T,s t＝i)用后向算法计算为：
β Ti＝1
Figure PCTCN2022128988-appb-000007
生成观测序列O的概率为：
Figure PCTCN2022128988-appb-000008
观测序列在t时刻状态s t为i的概率γ ti和观测序列在t时刻状态s t为i且t+1时刻状态s t+1为j的概率ξ tij的计算公式为：
Figure PCTCN2022128988-appb-000009
Figure PCTCN2022128988-appb-000010
迭代训练GMM-HMM模型参数的公式为：
Figure PCTCN2022128988-appb-000011
Figure PCTCN2022128988-appb-000012
Figure PCTCN2022128988-appb-000013
Figure PCTCN2022128988-appb-000014
其中，w {ik}，μ ik，Σ ik是第i个状态即第i个GMM模型中第k个高斯成分的参数，γ tik＝γ tir ik是观测序列在t时刻的观测值属于第i个状态第k个高斯成分的概率，其中
Figure PCTCN2022128988-appb-000015
是第i个状态中的样本属于第k个高斯成分的概率。
步骤3.6：根据训练好的GMM-HMM模型，将Verify id作为输入，使用前向-后向算法计算同一CAN ID中每个长度为T的周期序列样本的似然概率；
步骤3.7：统计上一步得到的似然概率的最小值为score id。
步骤4：使用训练好的GMM-HMM模型，计算被测报文序列每个CAN ID的周期序列的似然概率，通过与score的阈值作比较，来判断被测报文序列是否异常。
步骤4的具体步骤如下：
步骤4.1：对于每个被测的CAN ID，按时间顺序计算出该CAN ID所有报文的周期，形成一个周期序列；
步骤4.2：对于每个CAN ID的周期序列，将每个CAN ID划分为等长的，长度为T的周期序列组成的向量Test id，其中T根据经验设置为150；长度T在设置时可以选择与模型训练时设定的长度一致，也可以不一致；长度一致时可以达到更好的检测效果；
步骤4.3：将Test id作为输入，使用前向-后向算法利用每个CAN ID对应的GMM-HMM模型计算每个CAN ID的每个周期序列的似然概率；
步骤4.4：将计算出来的似然概率与score id的阈值作比较，如果计算获得的似然概率小于阈值范围，则判断为异常周期序列，其中阈值范围根据经验设置为
Figure PCTCN2022128988-appb-000016
本发明的有益效果是：本发明提供了一种CAN总线入侵检测方法，能够提取报文的不同发送周期和不同周期之间的转移关系，从而能够对向CAN总线***报文导致周期异常的情况进行检测，相对于解决同类问题的机器学习方法可解释性强，考虑特征更全面，训练速度快，所需算力少，能够应对未知的攻击模式。
说明书附图
图1是本发明入侵检测方法的流程图。
图2是本发明方法中GMM-HMM模型结构图。
图3是本发明方法中GMM模型的结构图。
具体实施方式
结合以下具体实施例和附图，对发明作进一步的详细说明。实施本发明的过程、条件、实验方法等，除以下专门提及的内容之外，均为本领域的普遍知识和公知常识，本发明没有特别限制内容。
本发明提供了一种基于GMM-HMM的车载网络CAN总线入侵检测方法，具体实施步骤如下：
步骤1：获取CAN总线正常报文。
步骤2：对于每个CAN ID，按时间顺序计算出该CAN ID所有报文的周期，形成一个周期序列。
步骤3：对每个CAN ID的周期序列构建和训练一个GMM-HMM模型，并计算正常序列的最小似然概率score id。
步骤3.1：搭建GMM-HMM算法模型，所述算法模型中包括一个或多个GMM模型，每个GMM模型是HMM模型的一个状态，HMM模型的状态两两之间存在概率转移关系。
步骤3.2：设定GMM-HMM算法的训练参数，算法迭代轮数c＝10，迭代收敛阈值tol＝0.01，GMM模型即HMM模型状态的个数n＝4，每个GMM模型的高斯成分的个数K＝2，HMM模型状态初始概率π、状态转移矩阵A以及每个GMM模型中每个高斯成分的均值μ、方差∑、权重w；对HMM模型状态初始概率π、状态转移矩阵A以及每个GMM模型中每个高斯成分的均值μ、方差∑、权重w做随机初始化；所述HMM模型状态初始概率π、状态转移矩阵A以及每个GMM模型中每个高斯成分的均值μ、方差∑、权重w为模型训练时进行迭代的参数。
步骤3.3：对于每个CAN ID的周期序列，分别将其划分为长度为T ＝150的周期序列组成的向量Cycle id，其中下标表示CAN ID。
步骤3.4：将Cycle id向量划分成训练集Train id和验证集Verify id两部分。
步骤3.5：将Train id作为输入，借助python hmmlearn库训练GMM-HMM模型的模型参数。
步骤3.6：根据训练好的GMM-HMM模型，将Verify id作为输入，借助python hmmlearn库计算每个周期序列样本的似然概率。
步骤3.7：统计上一步得到的似然概率的最小值为score id。
步骤4：使用训练好的GMM-HMM模型，计算被测报文序列每个CAN ID的周期序列的似然概率，通过与score的阈值作比较，来判断被测报文序列是否异常。
步骤4.1：对于被测的每个CAN ID，按时间顺序计算出该CAN ID所有报文的周期，形成一个周期序列。
步骤4.2：对于每个CAN ID的周期序列，分别将其划分为长度为T＝150的周期序列组成的向量Test id，其中下标表示CAN ID。
步骤4.3：将Test id作为输入，借助python hmmlearn库计算每个模型生成每个周期序列的似然概率。
步骤4.4：将计算出来的似然概率与score id的阈值比较，设定阈值为
Figure PCTCN2022128988-appb-000017
如果小于阈值范围
Figure PCTCN2022128988-appb-000018
则判断为异常周期序列。
实施例1
使用CANoe连接汽车OBD接口，采集30分钟CAN总线报文保存到本地，对采集的报文进行预处理，提取出时间戳、CAN ID、DLC和数 据等信息，作为基于本方法的输入报文，训练出其中每个CAN ID的GMM-HMM模型，然后将模型部署到CAN总线网关上，对总线上存在的报文进行监听，记录每个CAN ID出现的时间戳并计算出周期，保存最近150个周期最为被测周期序列，通过模型计算出似然概率，来判断该周期序列是否异常，若出现异常则产生警告显示在仪表上。
本发明的保护内容不局限于以上实施例。在不背离发明构思的精神和范围下，本领域技术人员能够想到的变化和优点都被包括在本发明中，并且以所附的权利要求书为保护范围。

Claims (7)

  1. 一种车载网络CAN总线入侵检测方法，其特征在于，包括以下步骤：
    步骤1：获取车载网络CAN总线正常报文；
    步骤2：对于每个CAN ID，按时间顺序计算出该CAN ID所有报文的周期，形成一个周期序列，作为GMM-HMM的算法输入；
    步骤3：对于每个CAN ID的周期序列，为其构建和训练一个GMM-HMM模型M id，并计算在该模型中，该CAN ID正常序列的最小似然概率score id；
    步骤4：使用每个训练好的GMM-HMM模型M id，计算被测报文序列中模型对应CAN ID的周期序列的似然概率，将其与对应CAN ID的score id的阈值作比较，来判断被测报文序列是否异常。
  2. 根据权利要求1所述的车载网络CAN总线入侵检测方法，其特征在于，步骤1中，所述报文的信息包括时间戳、CAN ID、数据长度码DLC、数据。
  3. 根据权利要求1所述的车载网络CAN总线入侵检测方法，其特征在于，步骤2中，所述计算的周期为相同CAN ID的任意连续两帧报文之间的时间间隔；所述报文周期的计算方法为连续两帧报文中后一帧报文的时间戳减去前一帧报文的时间戳所得的差值。
  4. 根据权利要求1所述的车载网络CAN总线入侵检测方法，其特征在于，所述步骤3具体包括以下步骤：
    步骤3.1：搭建GMM-HMM算法模型，所述算法模型中包括一个或多个GMM模型，每个GMM模型是HMM模型的一个状态，HMM模型 的状态两两之间存在概率转移关系；
    步骤3.2：设定GMM-HMM算法的训练参数，包括算法迭代轮数c，迭代收敛阈值tol，GMM模型即HMM模型状态的个数n，每个GMM模型的高斯成分的个数K，HMM模型状态初始概率π、状态转移概率矩阵A，以及每个GMM模型中每个高斯成分的均值μ、方差∑、权重w；迭代过程中达到设定的迭代轮数或迭代收敛阈值，则迭代结束；
    步骤3.3：对于每个CAN ID的周期序列，将每个CAN ID的周期序列划分为等长的，长度为T的周期序列组成的向量Cycle id，其中T设置为100～200；
    步骤3.4：将Cycle id向量划分成训练集Train id和验证集Verify id两部分，要求训练集和验证集没有重叠部分，两者的划分比例设置为(4～9)∶1；
    步骤3.5：将Train id作为输入，使用Baum-Welch算法训练GMM-HMM模型的模型参数；
    步骤3.6：根据训练好的GMM-HMM模型，将Verify id作为输入，使用前向-后向算法计算同一CAN ID中每个长度为T的周期序列样本的似然概率；
    步骤3.7：统计上一步得到的似然概率的最小值为score id。
  5. 根据权利要求1所述的车载网络CAN总线入侵检测方法，其特征在于，所述步骤4具体包括以下步骤：
    步骤4.1：对于被测的每个CAN ID，按时间顺序计算出该CAN ID所有报文的周期，形成一个周期序列；
    步骤4.2：对于每个CAN ID的周期序列，将每个CAN ID的周期序 列划分为等长的，长度为T的周期序列组成的向量Test id，其中T设置为100～200；
    步骤4.3：将Test id作为输入，使用前向-后向算法利用每个CAN ID对应的GMM-HMM模型计算每个CAN ID的每个周期序列的似然概率；
    步骤4.4：将计算出来的似然概率与score id的阈值作比较，如果计算出的似然概率小于阈值范围，则判断为异常周期序列，其中阈值范围设置为0.3score id～0.7score id。
  6. 一种实现如权利要求1-5之任一项所述方法的***，其特征在于，所述***包括：数据预处理模块，模型训练模块，异常检测模块。
  7. 如权利要求6所述的***，其特征在于，所述数据预处理模块用于对输入的车载网络CAN总线正常报文进行预处理；所述预处理操作包括将报文按照CAN ID分类，然后分别计算出它们的报文周期序列，再分割成等长的周期序列样本，最后划分出训练集和验证集；
    所述模型训练模块训练和确定各个GMM-HMM模型的参数，包括算法迭代轮数c，迭代收敛阈值tol，GMM模型即HMM模型状态的个数n，每个GMM模型的高斯成分的个数K，HMM模型状态初始概率π、状态转移矩阵A以及每个GMM模型中每个高斯成分的均值μ、方差∑、权重w；对HMM模型状态初始概率π、状态转移矩阵A以及每个GMM模型中每个高斯成分的均值μ、方差∑、权重w做随机初始化，然后根据训练好的模型计算验证集中正常周期序列样本的最小似然概率；所述HMM模型状态初始概率π、状态转移矩阵A以及每个GMM模型中每个高斯成分的均值μ、方差∑、权重w为模型训练时进行迭代的参数；
    所述异常检测模块负责对被测报文序列进行检测，首先将报文按照CAN ID分类，然后计算出被测报文序列的周期序列，接着每次对被测报文的每个周期序列样本计算其似然概率，通过比较该似然概率与正常样本的最小似然概率的大小，来判断该样本是否异常。
PCT/CN2022/128988 2021-11-02 2022-11-01 一种车载网络can总线入侵检测方法及*** WO2023078243A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111287157.3 2021-11-02
CN202111287157.3A CN114124472B (zh) 2021-11-02 2021-11-02 一种基于gmm-hmm的车载网络can总线入侵检测方法及***

Publications (1)

Publication Number Publication Date
WO2023078243A1 true WO2023078243A1 (zh) 2023-05-11

Family

ID=80379861

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/128988 WO2023078243A1 (zh) 2021-11-02 2022-11-01 一种车载网络can总线入侵检测方法及***

Country Status (3)

Country Link
US (1) US11985005B2 (zh)
CN (1) CN114124472B (zh)
WO (1) WO2023078243A1 (zh)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114124472B (zh) * 2021-11-02 2023-07-25 华东师范大学 一种基于gmm-hmm的车载网络can总线入侵检测方法及***
CN114615086B (zh) * 2022-04-14 2023-11-03 合肥工业大学 一种车载can网络入侵检测方法
CN114760163B (zh) * 2022-04-22 2024-01-12 惠州华阳通用电子有限公司 一种can通信方法
CN114978617B (zh) * 2022-05-06 2023-08-08 国网湖北省电力有限公司信息通信公司 一种基于马尔柯夫过程学习模型的网络攻击威胁统计判断方法
CN116366477B (zh) * 2023-05-30 2023-08-18 中车工业研究院(青岛)有限公司 一种列车网络通信信号检测方法、装置、设备及存储介质
CN116882505B (zh) * 2023-09-06 2023-12-12 北京理工大学 一种自我车辆高速公路场景下的车速预测方法及***
CN116915589A (zh) * 2023-09-12 2023-10-20 延锋伟世通电子科技（南京）有限公司 一种车载can总线网络报文异常检测方法
CN118016150A (zh) * 2023-11-30 2024-05-10 东莞博奥木华基因科技有限公司 一种检测遗传序列拷贝数变异的模型构建及其应用
CN117896181B (zh) * 2024-03-14 2024-05-31 山东云天安全技术有限公司 基于hmm模型的异常数据确定方法、装置、介质和设备

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109284705A (zh) * 2018-09-07 2019-01-29 电子科技大学 一种交通监控视频的异常检测方法
US20190188212A1 (en) * 2016-07-27 2019-06-20 Anomalee Inc. Prioritized detection and classification of clusters of anomalous samples on high-dimensional continuous and mixed discrete/continuous feature spaces
US20190222595A1 (en) * 2018-01-18 2019-07-18 General Electric Company Decision system and method for separating faults from attacks
CN110826054A (zh) * 2019-11-05 2020-02-21 哈尔滨工业大学 一种基于报文数据场特征的车载can总线入侵检测方法
CN111030962A (zh) * 2018-10-09 2020-04-17 厦门雅迅网络股份有限公司 车载网络入侵检测方法及计算机可读存储介质
CN111131185A (zh) * 2019-12-06 2020-05-08 中国电子科技网络信息安全有限公司 基于机器学习的can总线网络异常检测方法及装置
CN114124472A (zh) * 2021-11-02 2022-03-01 华东师范大学 一种基于gmm-hmm的车载网络can总线入侵检测方法及***

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8972253B2 (en) * 2010-09-15 2015-03-03 Microsoft Technology Licensing, Llc Deep belief network for large vocabulary continuous speech recognition
CN101977240A (zh) * 2010-11-15 2011-02-16 南开大学 基于iPhone智能手机的机器人人机交互***
US10142124B2 (en) * 2012-05-24 2018-11-27 Infineon Technologies Ag System and method to transmit data over a bus system
US8788731B2 (en) * 2012-07-30 2014-07-22 GM Global Technology Operations LLC Vehicle message filter
CN104217729A (zh) * 2013-05-31 2014-12-17 杜比实验室特许公司 音频处理方法和音频处理装置以及训练方法
US9652423B2 (en) * 2013-06-05 2017-05-16 Texas Instruments Incorporated CAN and flexible data rate CAN node apparatus and methods for mixed bus CAN FD communications
US9330045B2 (en) * 2013-10-02 2016-05-03 Nxp B.V. Controller area network (CAN) device and method for controlling CAN traffic
CN105810192B (zh) * 2014-12-31 2019-07-02 展讯通信（上海）有限公司 语音识别方法及其***
CN110149345B (zh) * 2019-06-11 2020-07-28 北京航空航天大学 一种基于报文序列预测的车载网络入侵检测方法
EP4078918B1 (en) * 2019-12-20 2023-11-08 Eduworks Corporation Real-time voice phishing detection
US20210196222A1 (en) * 2019-12-30 2021-07-01 Shanghai United Imaging Healthcare Co., Ltd. Systems and methods for reducing noise in imaging system
CN111882923A (zh) * 2020-07-15 2020-11-03 山东省网联智能车辆产业技术研究院有限公司 一种智能网联汽车行为辨识方法

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190188212A1 (en) * 2016-07-27 2019-06-20 Anomalee Inc. Prioritized detection and classification of clusters of anomalous samples on high-dimensional continuous and mixed discrete/continuous feature spaces
US20190222595A1 (en) * 2018-01-18 2019-07-18 General Electric Company Decision system and method for separating faults from attacks
CN109284705A (zh) * 2018-09-07 2019-01-29 电子科技大学 一种交通监控视频的异常检测方法
CN111030962A (zh) * 2018-10-09 2020-04-17 厦门雅迅网络股份有限公司 车载网络入侵检测方法及计算机可读存储介质
CN110826054A (zh) * 2019-11-05 2020-02-21 哈尔滨工业大学 一种基于报文数据场特征的车载can总线入侵检测方法
CN111131185A (zh) * 2019-12-06 2020-05-08 中国电子科技网络信息安全有限公司 基于机器学习的can总线网络异常检测方法及装置
CN114124472A (zh) * 2021-11-02 2022-03-01 华东师范大学 一种基于gmm-hmm的车载网络can总线入侵检测方法及***

Also Published As

Publication number Publication date
CN114124472B (zh) 2023-07-25
US20230137489A1 (en) 2023-05-04
CN114124472A (zh) 2022-03-01
US11985005B2 (en) 2024-05-14

Similar Documents

Publication Publication Date Title
WO2023078243A1 (zh) 一种车载网络can总线入侵检测方法及***
CN111294341B (zh) 基于自编码器和递归神经网络的车载***入侵检测方法
Qin et al. Application of controller area network (CAN) bus anomaly detection based on time series prediction
CN112202736A (zh) 基于统计学习和深度学习的工业控制***通信网络异常分类方法
WO2018076571A1 (zh) Lte网络中的异常值检测方法及***
CN109917777B (zh) 基于混合多采样率概率主成分分析模型的故障检测方法
CN111695823B (zh) 一种基于工控网络流量的异常评估方法与***
CN113079167B (zh) 一种基于深度强化学习的车联网入侵检测方法及***
CN113625681B (zh) Can总线异常检测方法、***及存储介质
CN113848417A (zh) 轨道交通供电设备故障预测方法及装置
CN110990788A (zh) 一种基于三元维纳过程的轴承剩余寿命预测方法
CN110620760A (zh) 一种SVM和贝叶斯网络的FlexRay总线融合入侵检测方法和检测装置
CN114679310A (zh) 一种网络信息安全检测方法
CN114285545B (zh) 一种基于卷积神经网络的侧信道攻击方法及***
Li et al. CAN bus messages abnormal detection using improved SVDD in Internet of Vehicles
CN108761250B (zh) 一种基于工控设备电压电流的入侵检测方法
CN116827641A (zh) 一种车载can总线异常流量检测溯源方法及***
CN115375038A (zh) 一种飞机发动机失效模式识别和寿命预测方法
Yang et al. Analysing business process anomalies using discrete-time markov chains
CN115205086A (zh) 移动轨迹大数据驱动的异常轨迹检测方法、***和电子设备
CN113254485A (zh) 实时数据流异常检测方法及***
Kanghao et al. A quantitative situation awareness approach for cbtc systems based on multi-dimensional Gaussian hidden Markov model
Sharshembiev et al. Protocol Misbehavior Analysis using Multivariate Statistical Analysis and Machine Learning in Vehicular Ad Hoc Networks.
CN111653087A (zh) 一种城市交通异常探测模型的构建方法
Pan et al. Quantifying Error Propagation in Multi-Stage Perception System of Autonomous Vehicles via Physics-Based Simulation

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22889267

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE