CN113428167B - ECU (electronic control Unit) abnormality recognition method - Google Patents

ECU (electronic control Unit) abnormality recognition method Download PDF

Info

Publication number
CN113428167B
CN113428167B CN202110978223.5A CN202110978223A CN113428167B CN 113428167 B CN113428167 B CN 113428167B CN 202110978223 A CN202110978223 A CN 202110978223A CN 113428167 B CN113428167 B CN 113428167B
Authority
CN
China
Prior art keywords
data
time
ecu
layer
representing
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202110978223.5A
Other languages
Chinese (zh)
Other versions
CN113428167A (en
Inventor
卢继武
许鹤
刘平
孟锦豪
刘义
张景哲
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Changsha Deyi Technology Co ltd
Original Assignee
Changsha Deyi Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Changsha Deyi Technology Co ltd filed Critical Changsha Deyi Technology Co ltd
Priority to CN202110978223.5A priority Critical patent/CN113428167B/en
Publication of CN113428167A publication Critical patent/CN113428167A/en
Application granted granted Critical
Publication of CN113428167B publication Critical patent/CN113428167B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • B60W50/02—Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
    • B60W50/0205—Diagnosing or detecting failures; Failure detection models
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/22—Matching criteria, e.g. proximity measures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/044—Recurrent networks, e.g. Hopfield networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • B60W2050/0001—Details of the control system
    • B60W2050/0019—Control system elements or transfer functions
    • B60W2050/0028—Mathematical models, e.g. for simulation
    • B60W2050/0037—Mathematical models of vehicle sub-units

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Artificial Intelligence (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Evolutionary Computation (AREA)
  • Software Systems (AREA)
  • Molecular Biology (AREA)
  • Automation & Control Theory (AREA)
  • Mathematical Physics (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Biophysics (AREA)
  • Computational Linguistics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Human Computer Interaction (AREA)
  • Transportation (AREA)
  • Mechanical Engineering (AREA)
  • Small-Scale Networks (AREA)
  • Testing And Monitoring For Control Systems (AREA)

Abstract

The invention discloses an ECU (electronic control unit) abnormality identification method, which is based on the high-speed acquisition and processing capacity of an FPGA (field programmable gate array) on the basis of fully researching a CAN bus protocol communication mechanism, improves the sampling rate and the characteristic calculation rate to the maximum extent, combines the advantages of an artificial neural network, designs an Enhanced LSTM neural network model based on an attention mechanism aiming at CAN bus time sequence characteristic data, is used for identifying the working state of a vehicle-mounted ECU (electronic control unit), and has stable and reliable performance.

Description

ECU (electronic control Unit) abnormality recognition method
Technical Field
The invention belongs to the field of vehicle-mounted safety, and particularly relates to an ECU (electronic control unit) abnormity identification method.
Background
With the continuous development of the automatic driving technology, Electronic Control Units (ECUs) and networking communication devices inside automobiles are more and more complex, the ECUs on high-grade cars may be hundreds, and vehicle-mounted networking modes include WiFi, 2G, 3G, 4G, 5G and the like. The increasing complexity and networking nature of modern automotive functions make the security of automobiles extremely challenging.
Any industry faces information security problems in the process of networking development, and the development of the internet of vehicles is no exception. Along with the continuous emergence of intelligent networking automobiles, threats such as malicious attack, illegal control, privacy disclosure and the like are increased day by day, and in addition, the application of an automatic driving auxiliary system and a new generation of electronic information technology on the automobiles ensures that the automobiles are more and more intelligent and can ensure the driving safety to a great extent, but at the same time, once the intelligent auxiliary functions are suddenly disabled or abnormal under a certain condition, the driving safety is seriously threatened. The networking of automobiles enables attackers to have an opportunity to access the vehicle-mounted network through various wired or wireless modes, acquire vehicle information and even remotely control the vehicles. No matter what kind of attack form, the final target of attacker is vehicle-mounted CAN bus, through the mode of sending malicious frame data, realizes the purpose of attacking, so CAN bus safety becomes the car networking safety and is also the most important line of defense at last, and the research CAN bus safety technique has very important meaning to whole car networking safety.
Generally, the CAN bus security protection means CAN be generally divided into two types, one is a protection means based on encryption and authentication, and the other is a protection means based on intrusion detection. The protection means based on encryption and authentication mainly authenticates frame data and ECU or encrypts messages by using a security key, because the number of effective load bits of a CAN data frame format is only 64 bits, the encryption inevitably increases the network load burden of a CAN bus, so that the communication efficiency is reduced, and the upgrading of the encryption means needs to upgrade the existing firmware. The protection method based on intrusion detection is to establish a detection model by analyzing the physical characteristics, statistical characteristics and the like of frames. The method has the characteristics that the communication burden of the CAN bus is not increased, but the detection speed is limited by the sampling rate and the feature extraction. At present, most of intrusion identification systems are still detection models established based on statistical characteristics, and the requirements of modern intelligent networked automobiles on safety are difficult to meet in the aspect of detection precision.
Most of the traditional abnormality identification systems detect the state of the ECU based on the data frame data message, the method cannot identify the interception and forgery attacks of the ECU, meanwhile, the data needs to be analyzed in an upper computer, and a certain time delay exists in the calculation processing process; however, as the number of the vehicle-mounted ECUs increases, the complexity also increases, and a general machine learning model cannot obtain high detection accuracy.
The CAN ID is usually generated automatically by the vehicle through information of an Electronic Control Unit (ECU), so the invention realizes the identification of ECU abnormality by adopting the correlation between the information of the ECU and the CAN ID, and improves the detection efficiency and precision.
Disclosure of Invention
In order to solve the problems, the invention discloses an ECU abnormality identification method.
In order to achieve the purpose, the technical scheme of the invention is as follows:
an ECU abnormality recognition method includes the steps of:
the method comprises the following steps of firstly, obtaining multidimensional time sequence data of the vehicle-mounted ECU characteristics, and specifically:
s1: two differential data lines of the CAN bus are connected to an ADC data acquisition circuit module through a wiring terminal, and the ADC data acquisition circuit module is arranged on an FPGA;
s2: the FPGA transmits data to the ADC data acquisition module through a wired communication protocol to acquire ADC sampling data, and acquires CAN ID and extraction characteristics through ADC waveform data time sequence frame ID analysis and waveform physical characteristic extraction; the CAN ID and the extracted features form multidimensional time sequence data of the fingerprint features of the vehicle-mounted ECU;
s3: sending the multidimensional time sequence data of the ECU fingerprint characteristics to an upper computer;
step two, obtaining an identity recognition model of an abnormality judgment logic for the vehicle-mounted CAN bus abnormality detection system, and specifically comprising the following steps:
l1: inputting the multidimensional time sequence data of the ECU fingerprint characteristics into an Enhanced LSTM neural network model;
l2: and the multidimensional time series data of the ECU fingerprint features are encoded and decoded in an Enhanced LSTM neural network model, so that the identification of the multidimensional time series data of the ECU fingerprint features is completed, and an ECU fingerprint feature identification result is obtained.
In a further improvement, the Enhanced LSTM neural network model is divided into an input layer, a hidden layer and an output layer in sequence.
In a further improvement, the Enhanced LSTM neural network model includes an encoding stage and a decoding stage, the encoding stage calculates respective weights for input multidimensional time series data features by using an attention mechanism of the Enhanced LSTM model, and extracts the most relevant features, and the encoding process is as follows:
a. when a given multi-dimensional time series dataset (X, y):
Figure DEST_PATH_IMAGE001
Figure DEST_PATH_IMAGE003
wherein X represents input data of one sample,
Figure DEST_PATH_IMAGE005
Representing the dimension of the input time series data,
Figure DEST_PATH_IMAGE007
The mark of the sample is shown,
Figure 308970DEST_PATH_IMAGE007
Adopts a one-hot coding mode,
Figure DEST_PATH_IMAGE009
Indicating a normal probability of recognition,
Figure DEST_PATH_IMAGE011
Representing a probability of being identified as an anomaly;
b. the input data first passes through an encoding layer of an Enhanced LSTM model attention mechanism, and the q-th input characteristic is assumed to be encoded at the time t, and the encoding process is as follows:
Figure DEST_PATH_IMAGE013
wherein
Figure DEST_PATH_IMAGE015
Representing a parameter matrix of an output layer of an encoding stage,
Figure DEST_PATH_IMAGE017
Expressed are (weight parameter matrix of middle hidden layer in encoding stage),
Figure DEST_PATH_IMAGE019
Representing the deflection parameter matrix of the middle hidden layer in the encoding stage,
Figure DEST_PATH_IMAGE021
Representing the similarity between the hidden state vector and the q-th feature of the input multi-dimensional time-series data at time t,
Figure DEST_PATH_IMAGE023
The q-th feature of the input sample data at time t,
Figure DEST_PATH_IMAGE025
Indicating the state of the hidden unit at time t-1,
Figure DEST_PATH_IMAGE027
Showing the state of the memory cell at time t-1,
Figure DEST_PATH_IMAGE029
() Representing a hyperbolic tangent activation function;
c. according to the similarity of all the features, the attention weight ratio of the qth feature at the time t is obtained
Figure DEST_PATH_IMAGE031
The formula is as follows:
Figure DEST_PATH_IMAGE033
Figure DEST_PATH_IMAGE035
represents a normalized exponential function, wherein
Figure DEST_PATH_IMAGE037
According toThe attention weight of all the features at the moment t is obtained by the formula
Figure DEST_PATH_IMAGE039
As shown in formula:
Figure DEST_PATH_IMAGE041
，
wherein
Figure DEST_PATH_IMAGE043
Representing a weight ratio of the nth feature;
d. after the weight of each feature of the input multi-dimensional time sequence data is obtained, multiplying the original input X of the sample by the corresponding weight to obtain the input data which is coded at the time t
Figure DEST_PATH_IMAGE045
As shown in formula:
Figure DEST_PATH_IMAGE047
Figure 774412DEST_PATH_IMAGE045
representing the encoded new input samples;
e. the traditional LSTM model is reformed, the states of all the stacked LSTM hidden layers are combined to obtain an Enhanced LSTM model,thidden unit state at time 1 is as follows:
Figure DEST_PATH_IMAGE049
where m is the number of LSTM hidden layers,
Figure DEST_PATH_IMAGE051
representing the hidden unit state of the mth layer neural network;
f. the state of the memory cell at time t-1 is similarly obtained as follows:
Figure DEST_PATH_IMAGE053
wherein
Figure DEST_PATH_IMAGE055
The memory unit state of the mth layer neural network is shown;
g. inputting the encoded data as an internal Enhanced LSTM unit of an Enhanced LSTM neural network model, which is as follows:
Figure DEST_PATH_IMAGE057
wherein p is the number of output layer nerve units of Enhanced LSTM,
Figure DEST_PATH_IMAGE059
Showing the improved LSTM neural network model,
Figure DEST_PATH_IMAGE061
Represents the state of the p-th hidden unit at the time t,
Figure DEST_PATH_IMAGE063
Is the first time of t-1pA hidden unit state
Figure DEST_PATH_IMAGE065
And memory cell state
Figure DEST_PATH_IMAGE067
A tuple of formula:
Figure DEST_PATH_IMAGE069
；
same as that
Figure DEST_PATH_IMAGE071
One tuple at time t.
h. In the decoding phase, the output of the Enhanced LSTM model is used
Figure DEST_PATH_IMAGE073
As input to the decoding layer, the similarity of the hidden unit states at time t is first calculated
Figure DEST_PATH_IMAGE075
As shown in formula:
Figure DEST_PATH_IMAGE077
wherein p is the number of output layer neural units in the coding stage is consistent with the number of Enhanced LSTM output layer hidden units,
Figure DEST_PATH_IMAGE079
Represents the weight coefficient matrix of the middle hidden layer in the decoding stage,
Figure DEST_PATH_IMAGE081
A matrix representing the bias coefficient of the middle hidden layer in the decoding stage,
Figure DEST_PATH_IMAGE083
Representing a decoding stage output layer parameter matrix;
i. and then calculating to obtain a weight ratio according to the similarity of the single output characteristics of the decoding layer and the similarity of all the characteristics of the decoding layer at the time t:
Figure DEST_PATH_IMAGE085
Figure DEST_PATH_IMAGE087
representing the output of the weighted ratio of the p-th hidden layer state of the Enhanced LSTM model;
j. then, the weight ratio and the hidden layer state are output
Figure DEST_PATH_IMAGE089
Multiplying to obtain decoded data
Figure DEST_PATH_IMAGE091
As shown in formula:
Figure DEST_PATH_IMAGE093
；
k. finally, the final output value at time t is obtained by using the full link layer
Figure DEST_PATH_IMAGE095
As shown in formula:
Figure DEST_PATH_IMAGE097
in a further improvement, the physical characteristics of the waveform include a mean value of the waveform sample, a standard deviation of the waveform sample, a covariance of the waveform sample, a rising slope of the waveform sample, a kurtosis of the waveform sample, a root mean square deviation of the waveform sample, a maximum value of the waveform sample, a minimum value of the waveform sample, and an energy of the waveform sample.
In a further development, the mean value of the waveform samples
Figure DEST_PATH_IMAGE099
The description of (A) is as follows:
Figure DEST_PATH_IMAGE101
standard deviation of the waveform samples
Figure DEST_PATH_IMAGE103
The description of (A) is as follows:
Figure DEST_PATH_IMAGE105
covariance of the waveform samples
Figure DEST_PATH_IMAGE107
Description of (1)Comprises the following steps:
Figure DEST_PATH_IMAGE109
kurtosis of the waveform sample
Figure DEST_PATH_IMAGE111
The description of (A) is as follows:
Figure DEST_PATH_IMAGE113
root mean square deviation of the waveform samples
Figure DEST_PATH_IMAGE115
The description of (A) is as follows:
Figure DEST_PATH_IMAGE117
maximum value of the waveform sample
Figure DEST_PATH_IMAGE119
The description of (A) is as follows:
Figure DEST_PATH_IMAGE121
minimum value of the waveform sample
Figure DEST_PATH_IMAGE123
The description of (A) is as follows:
Figure DEST_PATH_IMAGE125
energy of the waveform sample
Figure DEST_PATH_IMAGE127
The description of (A) is as follows:
Figure DEST_PATH_IMAGE129
wherein in the above formula
Figure DEST_PATH_IMAGE131
Representing the waveform sample values in the time domain; n is a frameThe number of sampling points of the data;
Figure DEST_PATH_IMAGE133
representing the sample value at the ith time instant.
In a further improvement, the multidimensional time sequence data of the ECU characteristics are uploaded to an upper computer in a serial port transmission mode.
The invention has the following advantages:
on the basis of fully researching a CAN bus protocol communication mechanism, the invention improves the sampling rate and the characteristic calculation rate to the maximum extent based on the high-speed acquisition processing capacity of the FPGA, combines the advantages of an artificial neural network, designs an Enhanced LSTM neural network model based on an attention mechanism aiming at CAN bus time sequence characteristic data, is used for identifying the working state of a vehicle-mounted ECU, and has stable and reliable performance.
Drawings
FIG. 1 is a vehicle CAN bus attack model of the present invention;
FIG. 2 is a data frame feature extraction algorithm idea framework of the present invention;
FIG. 3 is a block diagram of an ECU anomaly detection algorithm of the present invention;
FIG. 4 is a diagram of an Enhanced LSTM structure;
fig. 5 is a process diagram of an encoding stage of a prediction model.
Detailed Description
The invention is further explained with reference to the drawings and the embodiments.
Example 1:
as shown in fig. 1, in the vehicle-mounted CAN bus attack model, the in-vehicle gateway connects the CAN bus subnetwork and other vehicle-mounted communication networks, the ECU 2 and the ECU 3 are ECUs in a normal operating state, the ECU 1 is an abnormal ECU which CAN be an external intrusion ECU or controlled by a malicious attacker, and CAN transmit abnormal frames to the bus to realize attacks such as eavesdropping, disguising, replaying, counterfeiting and the like. Because data transmission on the CAN bus has a broadcasting characteristic and does not have any encryption and authentication mechanism, the ECUs which CAN be mounted on the same CAN subnet CAN receive all data frames on a channel, and the transmitted data frames CAN not effectively verify the identity information of a sender, so that the clamped ECU 1 CAN eavesdrop and disguise as other normal ECUs to transmit data information to implement replay attack. In addition, the arbitration scheme of the CAN bus is that the frame rate of the high priority is transmitted first, and if the ECU 1 continues to transmit the information of the high priority, the channel is blocked.
The detection principle is as follows: the vehicle-mounted ECU is an independent module, generally has an independent clock domain and a CAN transceiver, the circuit structure of the vehicle-mounted ECU is also quite different, and the clock circuit and data frames sent to the CAN bus have unique fingerprint characteristics due to different degrees of crosstalk characteristics generated by the circuit. The physical fingerprint characteristics of the data frame sent by the ECU are detected as the identification ID of the ECU.
The method comprises the steps of firstly, training and identifying the physical fingerprint characteristics of the original vehicle-mounted ECU of the CAN bus through a neural network, enabling the physical fingerprint characteristics to be in one-to-one correspondence with IDs in data frames, wherein when an external ECU invades, the physical fingerprint characteristics cannot be identified and CAN be judged as abnormal ECUs, and when an internal ECU is clamped and attacked, the physical fingerprint characteristics cannot be matched with the IDs and CAN also be identified as abnormal ECUs. By using the method, a series of attack behaviors caused by the invasion of the external ECU on the CAN bus or the clamping of the internal ECU CAN be effectively avoided.
As shown in fig. 2, the data frame feature extraction algorithm idea framework is that the CAN bus communication protocol includes two data lines, the signals of which are differential signals, the differential data lines are connected to a 14-bit high-speed ADC data acquisition circuit module through a connection terminal, the FPGA performs data transmission with the ADC data acquisition module through a wired communication protocol to acquire ADC sampling data, the FPGA performs analysis of ADC waveform data time sequence frame ID and extraction of waveform physical features inside the FPGA, and the extracted features are shown in table 1 below. Each frame of data has a CAN ID identifier, the CAN ID and the extracted features are packaged and transmitted to the upper computer in a serial port transmission mode to serve as the basis of next physical fingerprint feature identification.
TABLE 1 characterization and description thereof
Feature(s) Description of the invention
Mean value
Figure DEST_PATH_IMAGE134A
Standard deviation of
Figure DEST_PATH_IMAGE105A
Covariance
Figure DEST_PATH_IMAGE136A
Rising slope
Figure DEST_PATH_IMAGE137
Kurtosis
Figure DEST_PATH_IMAGE139
Root mean square difference
Figure DEST_PATH_IMAGE141
Maximum value
Figure DEST_PATH_IMAGE143
Minimum value
Figure DEST_PATH_IMAGE145
(Energy)
Figure DEST_PATH_IMAGE147
Figure DEST_PATH_IMAGE149
Representing the waveform sample values in the time domain; n is the number of sampling points of one frame data.
As shown in a framework diagram of an ECU anomaly detection algorithm shown in fig. 3, a PC upper computer receives a data packet collected and processed by an FPGA terminal to obtain time series data of fingerprint features of a vehicle-mounted ECU, 9 features are extracted from each frame of data, the data has multidimensional characteristics, aiming at the characteristics of the time series data, an Enhanced LSTM neural network model based on an attention mechanism is designed for feature recognition, the attention mechanism CAN be used for distinguishing the weight ratio of data with different dimensions to a prediction result, the LSTM (long-term memory network) model has a memory unit and is suitable for processing the time series data with a long-term effect, for a CAN data frame, the waveform physical characteristics of the CAN data frame are influenced by the integral effect of a hardware circuit and have correlation in time, so that the CAN be particularly suitable for processing by using the LSTM model, and researches show that the depth of the LSTM network is more important than the number of the memory units in improving the learning ability of the model, the attention-based LSTM neural network model designed herein is therefore particularly well suited for feature recognition anomaly classification of multi-dimensional time-series data.
The Enhanced LSTM structure shown in fig. 4 is composed of a plurality of basic LSTMs, and is different from the Stacked LSTM structure, and the Enhanced LSTM structure binds the hidden unit state and the memory state of each layer of LSTM unit at a certain time, so that the hidden unit state information and the memory state information of the current layer can be fully utilized, and meanwhile, the hidden unit state information and the memory state information of all layers except the current layer are used as auxiliary input information, thereby improving the prediction capability of the model network on time series data.
As shown in fig. 5, the encoding stage of the prediction model, the Enhanced LSTM neural network model based on attention mechanism proposed herein is mainly composed of two parts, i.e. an encoding stage and a decoding stage, each of which takes the Enhanced LSTM proposed herein as a basic encoder and decoder. As shown in fig. 5, the encoding stage of the prediction model is mainly to calculate respective weights for input multidimensional time series data features by using an attention mechanism, so as to extract the most relevant features; the decoding stage mainly performs attention weight distribution on different units of the hidden layer generated in the encoding stage to extract the most relevant hidden units. The main process is as follows:
in the encoding process, given a multi-dimensional time-series dataset (X, y):
Figure 174823DEST_PATH_IMAGE001
Figure DEST_PATH_IMAGE003A
wherein
Figure DEST_PATH_IMAGE151
N is the characteristic quantity of the input multi-dimensional time sequence data,
Figure DEST_PATH_IMAGE153
and representing the classification of the target features at the time t, and adopting a one-hot coding form.
Next, the input data first passes through an encoding layer of an attention mechanism, and it is assumed that the qth input feature is encoded at time t, and the encoding process is as follows:
Figure DEST_PATH_IMAGE013A
wherein
Figure DEST_PATH_IMAGE155
All are parameter matrixes obtained by model training,
Figure 920931DEST_PATH_IMAGE021
representing the similarity of the hidden state vector to the q-th feature of the input multi-dimensional time series data at time t. According to the similarity of all the features, the attention weight ratio of the qth input feature at the time t can be obtained according to the formula:
Figure DEST_PATH_IMAGE033A
according to the above method, attention weights of all features at time t can be obtained as follows:
Figure DEST_PATH_IMAGE157
after the weight of each feature of the input multi-dimensional time sequence data is obtained, multiplying the original data by the corresponding weight, thereby obtaining the input data which is coded at the time t as shown in the formula:
Figure DEST_PATH_IMAGE047A
next, the encoded data is used as the input of the Enhanced LSTM model part, so as to obtain the state of the hidden unit at the time t
Figure 213766DEST_PATH_IMAGE158
It is taken as input to the decoding stage:
Figure DEST_PATH_IMAGE057A
wherein
Figure DEST_PATH_IMAGE160A
Is the first time of t-1pA hidden unit state
Figure DEST_PATH_IMAGE162A
And memory cell state
Figure DEST_PATH_IMAGE164A
A tuple of formula:
Figure DEST_PATH_IMAGE166A
the conventional LSTM model is reconstructed, and the states of all stacked LSTM hidden layers are combined to obtain the hidden unit state at the t-1 moment as follows:
Figure DEST_PATH_IMAGE049A
where m is the number of LSTM hidden layers.
The state of the memory cell at time t-1 can also be obtained as follows:
Figure DEST_PATH_IMAGE167
in the decoding stage, the output of the Enhanced LSTM model is used as the input of the decoding layer, and similar to the idea of the encoding stage, the similarity of the hidden unit state at time t needs to be calculated first, as shown in the following formula:
Figure DEST_PATH_IMAGE077A
where p is the number of output layer neural units of Enhanced LSTM.
And then calculating according to the similarity of the single dimension and the similarity of all dimensions to obtain a weight ratio:
Figure DEST_PATH_IMAGE085A
then, the weight ratio and the hidden layer state are output
Figure 29537DEST_PATH_IMAGE089
The multiplication may result in decoded data. As shown in formula:
Figure DEST_PATH_IMAGE168A
finally, the final output value at time t is obtained by using the full link layer, as:
Figure DEST_PATH_IMAGE097A
the above process is the entire process of attention-based Enhanced LSTM neural network model anomaly identification presented herein.
While embodiments of the invention have been disclosed above, it is not limited to the applications set forth in the description and embodiments, which are fully applicable to various fields of endeavor for which the invention is intended, and further modifications may readily be effected therein by those skilled in the art, without departing from the general concept defined by the claims and their equivalents, which are to be limited not to the specific details shown and described herein.

Claims (5)

1. An ECU abnormality recognition method characterized by comprising the steps of:
the method comprises the following steps of firstly, obtaining multidimensional time sequence data of the vehicle-mounted ECU characteristics, and specifically:
s1: two differential data lines of the CAN bus are connected to an ADC data acquisition circuit module through a wiring terminal, and the ADC data acquisition circuit module is arranged on an FPGA;
s2: the FPGA transmits data to the ADC data acquisition module through a wired communication protocol to acquire ADC sampling data, and acquires CAN ID and extraction characteristics through ADC waveform data time sequence frame ID analysis and waveform physical characteristic extraction; the CAN ID and the extracted features form multidimensional time sequence data of the fingerprint features of the vehicle-mounted ECU;
s3: sending the multidimensional time sequence data of the ECU fingerprint characteristics to an upper computer;
step two, obtaining an identity recognition model of an abnormality judgment logic for the vehicle-mounted CAN bus abnormality detection system, and specifically comprising the following steps:
l1: inputting the multidimensional time sequence data of the ECU fingerprint characteristics into an Enhanced LSTM neural network model;
l2: the multidimensional time series data of the ECU fingerprint features are encoded and decoded in an Enhanced LSTM neural network model, so that the identification of the multidimensional time series data of the ECU fingerprint features is completed, and an ECU fingerprint feature identification result is obtained;
the Enhanced LSTM neural network model comprises an encoding stage and a decoding stage, wherein the encoding stage is used for calculating respective weights of input multi-dimensional time series data characteristics by using an attention mechanism of the Enhanced LSTM model and extracting the most relevant characteristics, and the encoding process is as follows:
a. when a given multi-dimensional time series dataset (X, y):
Figure 754376DEST_PATH_IMAGE001
Figure DEST_PATH_IMAGE002
wherein X represents input data of one sample,
Figure 999412DEST_PATH_IMAGE003
representing the dimensions of the input multi-dimensional time series data,
Figure DEST_PATH_IMAGE004
what is shown is the identity of the sample,
Figure 638204DEST_PATH_IMAGE004
the one-hot coding form is adopted,
Figure 892468DEST_PATH_IMAGE005
indicating the probability of being identified as normal,
Figure DEST_PATH_IMAGE006
representing a probability of being identified as an anomaly;
b. the input data first passes through an encoding layer of an Enhanced LSTM model attention mechanism, and the q-th input characteristic is assumed to be encoded at the time t, and the encoding process is as follows:
Figure 237998DEST_PATH_IMAGE007
wherein
Figure DEST_PATH_IMAGE008
Representing a parameter matrix of an output layer of an encoding stage,
Figure 450674DEST_PATH_IMAGE009
Representing the weight parameter matrix of the middle hidden layer in the encoding stage,
Figure DEST_PATH_IMAGE010
Representing the deflection parameter matrix of the middle hidden layer in the encoding stage,
Figure 245936DEST_PATH_IMAGE011
Representing the similarity between the hidden state vector and the q-th feature of the input multi-dimensional time-series data at time t,
Figure DEST_PATH_IMAGE012
The q-th feature of the input sample data at time t,
Figure 772732DEST_PATH_IMAGE013
Indicating the state of the hidden unit at time t-1,
Figure DEST_PATH_IMAGE014
Showing the state of the memory cell at time t-1,
Figure 97403DEST_PATH_IMAGE015
() Representing a hyperbolic tangent activation function;
c. according to the similarity of all the features, the attention weight ratio of the qth feature at the time t is obtained
Figure DEST_PATH_IMAGE016
The formula is as follows:
Figure 621925DEST_PATH_IMAGE017
Figure DEST_PATH_IMAGE018
represents a normalized exponential function, wherein
Figure 766468DEST_PATH_IMAGE019
According to the formula, the attention weight of all the features at the moment t is obtained
Figure DEST_PATH_IMAGE020
As shown in formula:
Figure 831376DEST_PATH_IMAGE021
，
wherein
Figure DEST_PATH_IMAGE022
Representing a weight ratio of the nth feature;
d. after the weight of each feature of the input multi-dimensional time sequence data is obtained, multiplying the original input X of the sample by the corresponding weight to obtain the input data which is coded at the time t
Figure 888849DEST_PATH_IMAGE023
As shown in formula:
Figure DEST_PATH_IMAGE024
Figure 708907DEST_PATH_IMAGE023
representing the encoded new input samples;
e. the traditional LSTM model is modified, the states of all stacked LSTM hidden layers are combined to obtain an Enhanced LSTM model, and the hidden unit state at the t-1 moment is as follows:
Figure 684953DEST_PATH_IMAGE025
where m is the number of LSTM hidden layersThe amount of the compound (A) is,
Figure DEST_PATH_IMAGE026
representing the hidden unit state of the mth layer neural network;
f. the state of the memory cell at time t-1 is similarly obtained as follows:
Figure 350289DEST_PATH_IMAGE027
wherein
Figure DEST_PATH_IMAGE028
The memory unit state of the mth layer neural network is shown;
g. inputting the encoded data as an internal Enhanced LSTM unit of an Enhanced LSTM neural network model, which is as follows:
Figure 524919DEST_PATH_IMAGE029
wherein p is the number of output layer nerve units of Enhanced LSTM,
Figure DEST_PATH_IMAGE030
Showing the improved LSTM neural network model,
Figure 187981DEST_PATH_IMAGE031
Represents the state of the p-th hidden unit at the time t,
Figure DEST_PATH_IMAGE032
Is the first time of t-1pA hidden unit state
Figure 593203DEST_PATH_IMAGE033
And memory cell state
Figure DEST_PATH_IMAGE034
A tuple, e.g. ofFormula (II):
Figure 937597DEST_PATH_IMAGE035
；
same as that
Figure DEST_PATH_IMAGE036
Is a tuple at time t;
h. in the decoding phase, the output of the Enhanced LSTM model is used
Figure 763470DEST_PATH_IMAGE037
As input to the decoding layer, the similarity of the hidden unit states at time t is first calculated
Figure DEST_PATH_IMAGE038
As shown in formula:
Figure 394172DEST_PATH_IMAGE039
wherein p is the number of output layer neural units in the coding stage is consistent with the number of Enhanced LSTM output layer hidden units,
Figure DEST_PATH_IMAGE040
Represents the weight coefficient matrix of the middle hidden layer in the decoding stage,
Figure 266182DEST_PATH_IMAGE041
A matrix representing the bias coefficient of the middle hidden layer in the decoding stage,
Figure DEST_PATH_IMAGE042
Representing a decoding stage output layer parameter matrix;
i. and then calculating to obtain a weight ratio according to the similarity of the single output characteristics of the decoding layer and the similarity of all the characteristics of the decoding layer at the time t:
Figure 414266DEST_PATH_IMAGE043
Figure DEST_PATH_IMAGE044
representing the output of the weighted ratio of the p-th hidden layer state of the Enhanced LSTM model;
j. then, the weight ratio and the hidden layer state are output
Figure 425472DEST_PATH_IMAGE045
Multiplying to obtain decoded data
Figure DEST_PATH_IMAGE046
As shown in formula:
Figure 695916DEST_PATH_IMAGE047
；
k. finally, the final output value at time t is obtained using the full link layer
Figure DEST_PATH_IMAGE048
As shown in formula:
Figure 399430DEST_PATH_IMAGE049
Figure DEST_PATH_IMAGE050
indicating the probability that the fingerprint feature of the ECU input at the time t is normal
Figure 147943DEST_PATH_IMAGE051
And probability of being an anomaly
Figure DEST_PATH_IMAGE052
。
2. The method of claim 1, wherein the Enhanced LSTM neural network model is sequentially divided into an input layer, a hidden layer, and an output layer.
3. The ECU abnormality recognition method according to claim 1, wherein the waveform physical characteristics include a mean value of the waveform samples, a standard deviation of the waveform samples, a covariance of the waveform samples, a rising slope of the waveform samples, a kurtosis of the waveform samples, a root mean square deviation of the waveform samples, a maximum value of the waveform samples, a minimum value of the waveform samples, and an energy of the waveform samples.
4. The ECU abnormality recognition method according to claim 3, characterized in that the mean value of the waveform samples
Figure 10726DEST_PATH_IMAGE053
The description of (A) is as follows:
Figure DEST_PATH_IMAGE054
standard deviation of the waveform samples
Figure 655334DEST_PATH_IMAGE055
The description of (A) is as follows:
Figure DEST_PATH_IMAGE056
covariance of the waveform samples
Figure 905531DEST_PATH_IMAGE057
The description of (A) is as follows:
Figure DEST_PATH_IMAGE058
kurtosis of the waveform sample
Figure 520052DEST_PATH_IMAGE059
Is describedThe method comprises the following steps:
Figure DEST_PATH_IMAGE060
root mean square deviation of the waveform samples
Figure 112707DEST_PATH_IMAGE061
The description of (A) is as follows:
Figure DEST_PATH_IMAGE062
maximum value of the waveform sample
Figure 724954DEST_PATH_IMAGE063
The description of (A) is as follows:
Figure DEST_PATH_IMAGE064
minimum value of the waveform sample
Figure 527694DEST_PATH_IMAGE065
The description of (A) is as follows:
Figure DEST_PATH_IMAGE066
energy of the waveform sample
Figure 86851DEST_PATH_IMAGE067
The description of (A) is as follows:
Figure DEST_PATH_IMAGE068
wherein in the above formula
Figure 599260DEST_PATH_IMAGE069
Representing the waveform sample values in the time domain; n is the number of sampling points of one frame of data;
Figure DEST_PATH_IMAGE070
represents the ithThe sampled value of the moment.
5. The ECU abnormality recognition method according to claim 1, wherein the multidimensional time series data of the ECU characteristics are uploaded to an upper computer in a serial port transmission mode.
CN202110978223.5A 2021-08-25 2021-08-25 ECU (electronic control Unit) abnormality recognition method Active CN113428167B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110978223.5A CN113428167B (en) 2021-08-25 2021-08-25 ECU (electronic control Unit) abnormality recognition method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110978223.5A CN113428167B (en) 2021-08-25 2021-08-25 ECU (electronic control Unit) abnormality recognition method

Publications (2)

Publication Number Publication Date
CN113428167A CN113428167A (en) 2021-09-24
CN113428167B true CN113428167B (en) 2021-11-26

Family

ID=77797802

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110978223.5A Active CN113428167B (en) 2021-08-25 2021-08-25 ECU (electronic control Unit) abnormality recognition method

Country Status (1)

Country Link
CN (1) CN113428167B (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113992533B (en) * 2021-12-29 2022-03-22 湖南大学 Vehicle-mounted CAN bus data anomaly detection and identification method

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3337102B1 (en) * 2014-12-01 2020-03-25 Panasonic Intellectual Property Corporation of America Illegality detection electronic control unit, car onboard network system, and illegality detection method
US10728101B2 (en) * 2016-05-01 2020-07-28 Argus Cyber Security Ltd. In-vehicle network anomaly detection
US10496469B2 (en) * 2017-07-25 2019-12-03 Aurora Labs Ltd. Orchestrator reporting of probability of downtime from machine learning process
US11379284B2 (en) * 2018-03-13 2022-07-05 Nec Corporation Topology-inspired neural network autoencoding for electronic system fault detection
EP3594860B1 (en) * 2018-07-09 2024-05-08 Tata Consultancy Services Limited Sparse neural network based anomaly detection in multi-dimensional time series
US20210053574A1 (en) * 2019-08-21 2021-02-25 Micron Technology, Inc. Monitoring controller area network bus for vehicle control
US11427210B2 (en) * 2019-09-13 2022-08-30 Toyota Research Institute, Inc. Systems and methods for predicting the trajectory of an object with the aid of a location-specific latent map
US11999364B2 (en) * 2020-12-23 2024-06-04 Intel Corporation Systems and methods for intrusion detection in vehicle systems

Also Published As

Publication number Publication date
CN113428167A (en) 2021-09-24

Similar Documents

Publication Publication Date Title
Seo et al. GIDS: GAN based intrusion detection system for in-vehicle network
CN110149345B (en) Vehicle-mounted network intrusion detection method based on message sequence prediction
Foruhandeh et al. SIMPLE: Single-frame based physical layer identification for intrusion detection and prevention on in-vehicle networks
Song et al. Self-supervised anomaly detection for in-vehicle network using noised pseudo normal data
Ning et al. Attacker identification and intrusion detection for in-vehicle networks
Avatefipour et al. Linking received packet to the transmitter through physical-fingerprinting of controller area network
Qin et al. Application of controller area network (CAN) bus anomaly detection based on time series prediction
Tyree et al. Exploiting the shape of CAN data for in-vehicle intrusion detection
CN113162902B (en) Low-delay safe vehicle-mounted intrusion detection method based on deep learning
Han et al. PPM-InVIDS: Privacy protection model for in-vehicle intrusion detection system based complex-valued neural network
CN113428167B (en) ECU (electronic control Unit) abnormality recognition method
Jeong et al. CNN-based adaptive source node identifier for controller area network (CAN)
CN113179244A (en) Federal deep network behavior feature modeling method for industrial internet boundary safety
CN113904819A (en) Safety system applied to industrial control network
Yu et al. TCE-IDS: Time interval conditional entropy-based intrusion detection system for automotive controller area networks
CN109660522B (en) Deep self-encoder-based hybrid intrusion detection method for integrated electronic system
Zhao et al. GVIDS: A reliable vehicle intrusion detection system based on generative adversarial network
Zhou et al. CANGuard: Practical intrusion detection for in-vehicle network via unsupervised learning
Zhou et al. A model-based method for enabling source mapping and intrusion detection on proprietary can bus
Deng et al. A lightweight sender identification scheme based on vehicle physical layer characteristics
CN116471062A (en) Vehicle-mounted network intrusion detection method supporting data privacy protection
CN113542222B (en) Zero-day multi-step threat identification method based on dual-domain VAE
Hafeez et al. Exploiting channel distortion for transmitter identification for in-vehicle network security
Li et al. Adaptive filter-based approach for phy fingerprints extraction of fast ethernet network
CN112996001A (en) Physical layer secure communication method based on radio frequency fingerprint image scrambling

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant