CN113660137B - Vehicle-mounted network fault detection method and device, readable storage medium and electronic equipment - Google Patents
Vehicle-mounted network fault detection method and device, readable storage medium and electronic equipment Download PDFInfo
- Publication number
- CN113660137B CN113660137B CN202110934136.XA CN202110934136A CN113660137B CN 113660137 B CN113660137 B CN 113660137B CN 202110934136 A CN202110934136 A CN 202110934136A CN 113660137 B CN113660137 B CN 113660137B
- Authority
- CN
- China
- Prior art keywords
- data
- neural network
- network model
- bus
- training
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 43
- 238000003062 neural network model Methods 0.000 claims abstract description 94
- 238000012549 training Methods 0.000 claims abstract description 60
- 125000004122 cyclic group Chemical group 0.000 claims abstract description 58
- 238000000034 method Methods 0.000 claims abstract description 28
- 230000000306 recurrent effect Effects 0.000 claims description 16
- 238000012795 verification Methods 0.000 claims description 15
- 230000006870 function Effects 0.000 claims description 6
- ORILYTVJVMAKLC-UHFFFAOYSA-N Adamantane Natural products C1C(C2)CC3CC1CC2C3 ORILYTVJVMAKLC-UHFFFAOYSA-N 0.000 claims description 4
- 238000012360 testing method Methods 0.000 claims description 4
- 238000005457 optimization Methods 0.000 claims description 2
- 238000007477 logistic regression Methods 0.000 claims 1
- 230000002159 abnormal effect Effects 0.000 abstract description 9
- 238000012216 screening Methods 0.000 abstract description 3
- 238000004891 communication Methods 0.000 description 5
- 230000000694 effects Effects 0.000 description 5
- 238000012545 processing Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 4
- 230000005856 abnormality Effects 0.000 description 3
- 238000004590 computer program Methods 0.000 description 3
- 206010063385 Intellectualisation Diseases 0.000 description 2
- 238000003491 array Methods 0.000 description 2
- 238000013528 artificial neural network Methods 0.000 description 2
- 238000013135 deep learning Methods 0.000 description 2
- 238000013136 deep learning model Methods 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 239000004973 liquid crystal related substance Substances 0.000 description 2
- 239000000463 material Substances 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012544 monitoring process Methods 0.000 description 2
- 230000006855 networking Effects 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 238000013139 quantization Methods 0.000 description 2
- 230000004044 response Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 238000005265 energy consumption Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000002955 isolation Methods 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 238000011056 performance test Methods 0.000 description 1
- 230000000704 physical effect Effects 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/50—Testing arrangements
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/40—Bus networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/147—Network analysis or design for predicting network behaviour
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0805—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/40—Bus networks
- H04L2012/40208—Bus networks characterized by the use of a particular bus standard
- H04L2012/40215—Controller Area Network CAN
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/40—Bus networks
- H04L2012/40267—Bus for use in transportation systems
- H04L2012/40273—Bus for use in transportation systems the transportation system being a vehicle
Abstract
A vehicle-mounted network fault detection method, a device, a readable storage medium and an electronic device, wherein the method comprises the following steps: acquiring a CAN bus data set, wherein the CAN bus data set comprises various state data of CAN frames on a CAN bus at various moments and corresponding fault information; constructing a cyclic neural network model, and training the cyclic neural network model by utilizing the CAN bus data set; and inputting various state data of the current CAN frame on the CAN bus into the trained cyclic neural network model, and acquiring the current fault occurrence probability output by the cyclic neural network model. The method can carry out online real-time protection on the vehicle-mounted network, can carry out real-time screening on the abnormal data report, and plays an important role in safety protection of the vehicle-mounted network.
Description
Technical Field
The present invention relates to the field of automobiles, and in particular, to a method and apparatus for detecting a vehicle-mounted network fault, a readable storage medium, and an electronic device.
Background
With the continuous development of the internet of things technology, the concept of the connection of things gradually goes deep into the heart, more and more industries lay on the technical innovation of the internet of things, and the automobile industry is typical. In order to further improve the comfort and ease of driving the vehicle, networking and intellectualization become the necessary direction of vehicle development.
The networking trend of vehicles greatly increases the opening degree of the vehicles, and interfaces for communication between the vehicles and the outside, such as bluetooth, wi-Fi, 4G, etc., are widely used, and these interfaces increase the risk of being attacked by the network. Meanwhile, the trend of vehicle intellectualization has prompted the complexity of in-vehicle electronic networks to increase rapidly. The number of electronic control units (Electronic Control Unit, ECU) as core elements of the electronic system in the vehicle can reach hundreds, which inevitably leads to an increase in network vulnerabilities and an expansion of attack areas. The vehicle's openness and complexity of the in-vehicle electronic network make the risk of the vehicle being attacked reach an unprecedented point, the controller area network (Controller Area Network, CAN) bus, which is one of the main buses of the in-vehicle electronic network, is more vulnerable to its security. In recent years, aiming at the automobile network attack event of the CAN bus, the automobile network attack event is endless. How to carry out safety protection on an automobile network becomes a current problem to be solved urgently.
Disclosure of Invention
In view of the foregoing, it is necessary to provide a vehicle network fault detection method, apparatus, readable storage medium and electronic device for protecting a vehicle network from safety.
A vehicle-mounted network fault detection method, comprising:
acquiring a CAN bus data set, wherein the CAN bus data set comprises various state data of CAN frames on a CAN bus at various moments and corresponding fault information;
constructing a cyclic neural network model, and training the cyclic neural network model by utilizing the CAN bus data set;
and inputting various state data of the current CAN frame on the CAN bus into the trained cyclic neural network model, and acquiring the current fault occurrence probability output by the cyclic neural network model.
Further, in the above vehicle network fault detection method, the step of acquiring the CAN bus data set includes:
and acquiring CAN frames on the CAN bus at each moment, and respectively serializing according to frame types to obtain various state data, wherein each type of state data comprises frame start data, arbitration field data, control field data, data field data, CRC field data, ACK field data and frame end data.
Further, in the vehicle network fault detection method, the step of training the recurrent neural network model by using the CAN bus data set includes:
randomly dividing the CAN bus data set into training set data and verification set data according to a K-Fold method;
training the cyclic neural network model by utilizing the training set data, and adaptively adjusting the super parameters in the cyclic neural network model;
and verifying the trained cyclic neural network model by using the verification set data.
Further, in the vehicle network fault detection method, the step of training the recurrent neural network model by using the training set data includes:
respectively inputting various state data and corresponding time sequences in the training set data into the cyclic neural network model, and outputting corresponding fault occurrence probability;
and according to the fault information at each moment in the training set data and the fault occurrence probability, the super parameters of the neural network model are adaptively adjusted.
Further, in the vehicle-mounted network fault detection method, the step of obtaining the current fault occurrence probability output by the recurrent neural network model further includes:
judging whether the fault occurrence probability is larger than a threshold value or not;
if yes, pushing alarm information to a preset feed.
Further, in the vehicle-mounted network fault detection method, the circulating neural network model adopts a logistics regression function as an output layer, and adopts an Adam algorithm as an optimization algorithm of model parameters.
Further, in the vehicle network fault detection method, the cyclic neural network model adopts a GRU cyclic neural network model.
The invention also provides a vehicle-mounted network fault detection device, which comprises:
the acquisition module is used for acquiring a CAN bus data set, wherein the CAN bus data set comprises various state data of CAN frames on a CAN bus at various moments and corresponding fault information;
the model training module is used for constructing a cyclic neural network model and training the cyclic neural network model by utilizing the CAN bus data set;
the model test module is used for inputting various state data of the current CAN frame on the CAN bus into the trained cyclic neural network model and obtaining the current fault occurrence probability output by the cyclic neural network model.
Further, in the above vehicle-mounted network fault detection device, the obtaining module is configured to:
and acquiring CAN frames on the CAN bus at each moment, and respectively serializing according to frame types to obtain various state data, wherein each type of state data comprises frame start data, arbitration field data, control field data, data field data, CRC field data, ACK field data and frame end data.
Further, the vehicle-mounted network fault detection device, wherein the model training module comprises:
the data dividing unit is used for randomly dividing the CAN bus data set into training set data and verification set data according to a K-Fold method;
the model training unit is used for training the circulating neural network model by utilizing the training set data and adaptively adjusting the super parameters in the circulating neural network model;
and the model verification unit is used for verifying the trained cyclic neural network model by using the verification set data.
Further, in the above vehicle-mounted network fault detection device, the model training unit is specifically configured to:
respectively inputting various state data and corresponding time sequences in the training set data into the cyclic neural network model, and outputting corresponding fault occurrence probability;
and according to the fault information at each moment in the training set data and the fault occurrence probability, the super parameters of the neural network model are adaptively adjusted.
Further, the above-mentioned vehicle network fault detection device further includes:
the judging module is used for judging whether the fault occurrence probability is larger than a threshold value or not;
and the information pushing module is used for pushing alarm information to a preset feed when the fault occurrence probability is greater than a threshold value.
The invention also discloses a readable storage medium having stored thereon a program which when executed by a processor implements any of the methods described above.
The invention also discloses an electronic device, which comprises a memory, a processor and a program stored on the memory and capable of running on the processor, wherein the processor realizes the method of any one of the above when executing the program.
According to the invention, the fault detection and the fault detection are performed according to the data on the vehicle-mounted CAN bus according to the time sequence by acquiring the data on the vehicle-mounted network bus and combining the trained cyclic neural network model. In this embodiment, a cyclic neural network is adopted, so that timely and efficient feedback CAN be performed on each frame of CAN frame data, and quantization CAN be performed. The method can carry out online real-time protection on the vehicle-mounted network, can carry out real-time screening on the abnormal data report, and plays an important role in safety protection of the vehicle-mounted network.
Drawings
Fig. 1 is a flowchart of a vehicle-mounted network fault detection method provided in a first embodiment of the present invention;
fig. 2 is a flowchart of a method for detecting a vehicle-mounted network fault according to a second embodiment of the present invention;
FIG. 3 is a schematic diagram illustrating the operation of a GRU neural network model in a second embodiment of the invention;
fig. 4 is a block diagram of a vehicle-mounted network fault detection device according to a third embodiment of the present invention;
fig. 5 is a block diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to like or similar elements or elements having like or similar functions throughout. The embodiments described below by referring to the drawings are illustrative only and are not to be construed as limiting the invention.
These and other aspects of embodiments of the invention will be apparent from and elucidated with reference to the description and drawings described hereinafter. In the description and drawings, particular implementations of embodiments of the invention are disclosed in detail as being indicative of some of the ways in which the principles of embodiments of the invention may be employed, but it is understood that the scope of the embodiments of the invention is not limited correspondingly. On the contrary, the embodiments of the invention include all alternatives, modifications and equivalents as may be included within the spirit and scope of the appended claims.
The vehicle-mounted network fault detection method CAN be applied to a single device, and the device CAN be directly arranged on a CAN bus; it can be understood that the vehicle-mounted network fault detection method can also be applied to an OBU, and program modules of the corresponding method are embedded in the OBU, so that the vehicle-mounted network fault detection method can be flexibly selected according to the current hardware conditions of the automobile during specific implementation.
The vehicle-mounted network fault detection method mainly monitors the datagram on the vehicle-mounted network bus to judge the normal/abnormal performance of the datagram, so that the problem of abnormality of the data on the vehicle-mounted network bus is screened, and when the problem occurs, the problem can be timely alarmed and recorded, and the problem of greater personal safety caused by the abnormality on the bus is prevented.
Referring to fig. 1, a vehicle network fault detection method according to a first embodiment of the present invention includes steps S11 to S13.
Step S11, a CAN bus data set is obtained, wherein the CAN bus data set comprises various state data of CAN frames on a CAN bus at various moments and corresponding fault information.
The CAN bus data is full data on the CAN line, and when the method is implemented, CAN frames on the CAN bus at each moment are acquired and respectively serialized according to frame types to obtain various state data. And carrying out decimal or hexadecimal serialization according to the frame type to obtain seven types of state data, namely frame start data, arbitration field data, control field data, data field data, CRC field data, ACK field data and frame end data. The seven types of state data are respectively used as input sources of the model, so that the effect of accurately identifying the attack introduced by non-data field errors such as flooding attack can be ensured.
In general, the attack modes of the vehicle CAN bus are classified into eavesdropping attack, spoofing attack, flooding attack, isolation attack, tamper attack and replay attack according to the different attack means. The fault information is the fault type corresponding to various attack modes.
And step S12, constructing a cyclic neural network model, and training the cyclic neural network model by utilizing the CAN bus data set.
The cyclic neural network model (RNN) is characterized in that the output result is affected by the previous input result, that is, the RNN can understand the time sequence relationship of the data. Aiming at the characteristics, the RNN can well learn the relation between front and back data in the vehicle-mounted bus datagram. Compared with other deep learning models, the model output of the RNN can take the influence of historical input into consideration, and plays an important role in recognition of abnormal datagrams on the vehicle-mounted network bus. For example, in a high-speed driving environment, the window is not suddenly rocked, or the engine is suddenly extinguished, and the relation is represented by the connection of the front logic and the rear logic between the datagrams. Other deep learning or statistic-based intrusion detection methods can show a better recognition effect on the recognition of the erroneous datagrams, but cannot solve the problem that the correct datagrams occur at incorrect times well. It should be noted that the RNN does not need to distinguish between data fields or arbitration fields for the identification of the in-vehicle network datagrams. In this way, not only maliciously injected high priority frames but also erroneous datagrams due to sensor failure can be identified, and also the untimely occurrence of legitimate frames can be accurately identified.
There are various types of neural network models, and in this embodiment, a GRU (Gated Recurrent Unit) neural network model is preferable. The GRU neural network model has a simple structure, and has good timeliness and energy consumption for vehicle-mounted network response.
When training the constructed cyclic neural network model, the model is input into 7 types of state data of CAN frames on a CAN bus at different moments, and the input sequence is shown in the following formula:
X∈{x t |t i ＜t＜t i+Δ }；
wherein x is t ＝[S t ，A t ，C t ，D t ，R t ，N t ，E t ]The variables are frame start data, arbitration field data, control field data, data field data, CRC field data, ACK field data, and frame end data. The output is the predicted CAN bus fault occurrence probability, and the output sequence is shown as follows:
Y∈{y t |t i ＜t＜t i+Δ }；
where yt represents the CAN bus failure occurrence probability.
And training the circulating neural network model by the CAN bus data set, and continuously debugging the super parameters in the model so as to enable the fault occurrence probability output by the model to be matched with the actual fault condition. The accuracy rate of the network fault prediction can be optimized through an iterative updating mode.
And S13, inputting various state data of a current CAN frame on a CAN bus into the trained cyclic neural network model, and acquiring the current fault occurrence probability output by the cyclic neural network model.
After the model is trained, various state data of the current CAN frame on the CAN bus are input into the trained cyclic neural network model, and the current fault occurrence probability is output.
According to the embodiment, the fault detection and the fault detection are performed according to the data on the vehicle-mounted CAN bus according to the time sequence by acquiring the data on the vehicle-mounted network bus and combining the trained cyclic neural network model. In this embodiment, a cyclic neural network is adopted, so that timely and efficient feedback CAN be performed on each frame of CAN frame data, and quantization CAN be performed. The method can carry out online real-time protection on the vehicle-mounted network, can carry out real-time screening on the abnormal data report, and plays an important role in safety protection of the vehicle-mounted network.
Referring to fig. 2, a method for detecting a vehicle network fault in a second embodiment of the present invention includes steps S21 to S28.
Step S21, CAN frames and corresponding fault information on the CAN bus at each moment are obtained, and are respectively serialized according to frame types to obtain various state data, and the obtained various state data and the corresponding fault information are used as CAN bus data sets. The state data comprises frame start data, arbitration field data, control field data, data field data, CRC field data, ACK field data and frame end data, and the state data of the CAN frames on the CAN bus at each moment.
7 kinds of state data of CAN frames at all times on the CAN bus are collected, and fault information at all times is recorded. The collected data is X epsilon { X } t |t i ＜t＜t i+Δ X, where x t ＝[St，A t ，C t ，D t ，R t ，N t ，E t ]The variables are frame start data, arbitration field data, control field data, data field data, CRC field data, ACK field data, and frame end data.
Specifically, the CAN bus data set CAN be acquired by adopting a CAN monitoring transceiver acquisition and artificial triggering mode. And recording the time and frame information data of the CAN frame, and recording fault input conditions at each moment.
And S22, constructing a cyclic neural network model.
In this embodiment, a GRU neural network model is adopted, and a logistics regression function is adopted as an output layer in the model, and the expression is as follows:
wherein,predicting probability of failure for the ith sample, y (i) Is the network output of the ith sample.
The GRU neural network model adopts an Adam self-adaptive learning rate method to update model parameters, and adopts a standard Adam self-adaptive learning method, so that the model parameters can be updated stably and are not easy to fall into local optimum.
And S23, randomly dividing the CAN bus data set into training set data and verification set data according to a K-Fold method.
And step S24, training the cyclic neural network model by utilizing the training set data, and adaptively adjusting the super parameters in the cyclic neural network model.
Further, the training the recurrent neural network model by using the training set data includes:
respectively inputting various state data and corresponding time sequences in the training set data into the cyclic neural network model, and outputting corresponding fault occurrence probability;
and according to the fault information at each moment in the training set data and the fault occurrence probability, the super parameters of the neural network model are adaptively adjusted.
As shown in fig. 3, the type 7 state data of CAN frames are input, and the acquisition time of each frame is used as a time index of 7 pieces of partial data, and the predicted failure probability is output. And the model adjusts the super parameters according to the input fault information at each moment.
And step S25, verifying the trained recurrent neural network model by using the verification set data.
The training set data is used as input of the GRU neural network model, the model is trained, the verification set data is used for testing the model, and super parameters in the GRU neural network model are further debugged.
In specific implementation, the time for training the cyclic neural network model can be selected when each vehicle model is researched and developed and tested in a factory, and abundant vehicle-mounted bus datagram learning samples in normal/abnormal states can be provided when a large number of mechanical/physical properties of each vehicle model are tested at the time. After the mechanical/performance test is completed, the cyclic neural network model is trained.
And S26, when the cyclic neural network model is verified to be qualified, inputting various state data of the current CAN frame on the CAN bus into the trained cyclic neural network model, and acquiring the current fault occurrence probability output by the cyclic neural network model.
When an actual automobile is delivered to a customer, the fault detection module inputs the data report on the CAN bus acquired in real time into a trained RNN model, and outputs the current fault occurrence probability.
And step S27, judging whether the fault occurrence probability is larger than a threshold value, and if so, executing step S28.
Step S28, pushing alarm information to a preset feed.
And judging that the probability of occurrence of the fault output by the model is larger than a threshold, judging that the CAN frame datagram is abnormal if the probability is higher than a set threshold, and indicating that the CAN frame datagram is normal if the probability is lower than the threshold.
It will be appreciated that the rules for the threshold setting are set to be in principle such that important faults are not missed, depending on the actual effect of the particular learning model. If the abnormality occurs continuously, it is determined that a fault has occurred.
When the fault is judged, the alarm information is pushed to a preset feed, wherein the feed can be an OBU, a mobile phone, a network early warning platform and other equipment capable of receiving or displaying the alarm information.
After receiving the alarm information, the user or driver can decide whether to check the car. The data determined to cause the failure is recorded. Under the condition of external Internet, the fault data can be transmitted to a network early warning platform, and the fault is judged by combining more extensive data to be caused by the fault of an own sensor of the automobile or the fault caused by illegal network intrusion.
In this embodiment, the total number of CAN frames is obtained and disassembled into 7 parts, and the acquisition time of each frame is used as the time index of 7 parts, and the time index is input into the trained neural network model, and the probability of occurrence of the fault is output. The neural network model adopts the GRU model, so that convergence can be achieved more quickly, training time is shortened, and response speed is high. According to the characteristic that the neural network model is sensitive to time sequence and characteristics, abnormal datagrams can be effectively screened out. The method can well detect the abnormal format datagram or the normal but untimely format datagram.
Referring to fig. 4, an on-vehicle network fault detection device according to a third embodiment of the present invention includes:
an acquiring module 41, configured to acquire a CAN bus data set, where the CAN bus data set includes various status data of a CAN frame on a CAN bus at each time, and corresponding fault information;
a model training module 42, configured to construct a recurrent neural network model, and train the recurrent neural network model using the CAN bus data set;
the model test module 43 is configured to input various status data of a current CAN frame on the CAN bus into the trained recurrent neural network model, and obtain a current failure occurrence probability output by the recurrent neural network model.
Further, in the above-mentioned vehicle-mounted network fault detection device, the obtaining module 41 is configured to:
and acquiring CAN frames on the CAN bus at each moment, and respectively serializing according to frame types to obtain various state data, wherein each type of state data comprises frame start data, arbitration field data, control field data, data field data, CRC field data, ACK field data and frame end data.
Further, in the above-mentioned vehicle network fault detection device, the model training module 42 includes:
the data dividing unit is used for randomly dividing the CAN bus data set into training set data and verification set data according to a K-Fold method;
the model training unit is used for training the circulating neural network model by utilizing the training set data and adaptively adjusting the super parameters in the circulating neural network model;
and the model verification unit is used for verifying the trained cyclic neural network model by using the verification set data.
Further, in the above vehicle-mounted network fault detection device, the model training unit is specifically configured to:
respectively inputting various state data and corresponding time sequences in the training set data into the cyclic neural network model, and outputting corresponding fault occurrence probability;
and according to the fault information at each moment in the training set data and the fault occurrence probability, the super parameters of the neural network model are adaptively adjusted.
Further, the above-mentioned vehicle network fault detection device further includes:
the judging module is used for judging whether the fault occurrence probability is larger than a threshold value or not;
and the information pushing module is used for pushing alarm information to a preset feed when the fault occurrence probability is greater than a threshold value.
The implementation principle and the generated technical effects of the vehicle-mounted network fault detection device provided by the embodiment of the invention are the same as those of the embodiment of the method, and for the sake of brief description, the corresponding contents in the embodiment of the method can be referred to for the parts of the embodiment of the device which are not mentioned.
In another aspect, referring to fig. 5, an electronic device according to a fourth embodiment of the present invention includes a processor 10, a memory 20, and a computer program 30 stored in the memory and capable of running on the processor, where the processor 10 implements the above-mentioned vehicle network fault detection method when executing the computer program 30.
It will be appreciated that the electronic device may be a separate unit that is mounted directly on the CAN bus; the electronic device may also be an OBU, in which a program module of a corresponding method is embedded, and the electronic device may be flexibly selected according to the current hardware conditions of the automobile when implemented.
When the electronic equipment is used as an independent device to be directly connected to the vehicle-mounted network bus, the electronic equipment can be matched with an on-board embedded system with a chip optimized by specialized deep learning to be connected to the vehicle-mounted network bus in a monitoring mode. And a module such as 4G/5G which can communicate with the external Internet is provided for updating the deep learning model and responding to fault analysis with higher speed.
When the electronic device is an OBU, in order to ensure the real-time performance and effect of detection, the OBU is ensured to have a certain CPU (Central processing Unit) computing power margin and expandable storage space.
The processor 10 may be, in some embodiments, a central processing unit (Central Processing Unit, CPU), controller, microcontroller, microprocessor or other data processing chip for executing program code or processing data stored in the memory 20.
The memory 20 includes at least one type of readable storage medium including flash memory, a hard disk, a multimedia card, a card memory (e.g., SD or DX memory, etc.), a magnetic memory, a magnetic disk, an optical disk, etc. The memory 20 may in some embodiments be an internal storage unit of the electronic device, such as a hard disk of the electronic device. The memory 20 may also be an external storage device of the electronic device in other embodiments, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash Card (Flash Card) or the like. Further, the memory 20 may also include both internal storage units and external storage devices of the electronic device. The memory 20 may be used not only for storing application software installed in an electronic device and various types of data, but also for temporarily storing data that has been output or is to be output.
Optionally, the electronic device may further comprise a user interface, which may comprise a Display (Display), an input unit such as a Keyboard (Keyboard), a network interface, a communication bus, etc., and an optional user interface may further comprise a standard wired interface, a wireless interface. Alternatively, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch, or the like. The display may also be referred to as a display screen or display unit, as appropriate, for displaying information processed in the electronic device and for displaying a visual user interface. The network interface may optionally include a standard wired interface, a wireless interface (e.g., WI-FI interface), and is typically used to establish a communication connection between the device and other electronic devices. The communication bus is used to enable connected communication between these components.
It should be noted that the structure shown in fig. 5 does not constitute a limitation of the electronic device, and in other embodiments the electronic device may comprise fewer or more components than shown, or may combine certain components, or may have a different arrangement of components.
The present invention also proposes a computer-readable storage medium, on which a computer program is stored, which when executed by a processor implements a vehicle-mounted network failure detection method as described above.
Those of skill in the art will appreciate that the logic and/or steps represented in the flow diagrams or otherwise described herein, e.g., a ordered listing of executable instructions for implementing logical functions, can be embodied in any computer-readable medium for use by or in connection with an instruction execution system or apparatus, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system or apparatus and execute the instructions. For the purposes of this description, a "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection (electronic device) having one or more wires, a portable computer diskette (magnetic device), a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). In addition, the computer readable medium may even be paper or other suitable medium on which the program is printed, as the program may be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.
It is to be understood that portions of the present invention may be implemented in hardware, software, firmware, or a combination thereof. In the above-described embodiments, the various steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, may be implemented using any one or combination of the following techniques, as is well known in the art: discrete logic circuits having logic gates for implementing logic functions on data signals, application specific integrated circuits having suitable combinational logic gates, programmable Gate Arrays (PGAs), field Programmable Gate Arrays (FPGAs), and the like.
In the description of the present specification, a description referring to terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiments or examples. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
The foregoing examples illustrate only a few embodiments of the invention and are described in detail herein without thereby limiting the scope of the invention. It should be noted that it will be apparent to those skilled in the art that several variations and modifications can be made without departing from the spirit of the invention, which are all within the scope of the invention. Accordingly, the scope of protection of the present invention is to be determined by the appended claims.
Claims (8)
1. A vehicle-mounted network fault detection method, characterized by comprising:
acquiring a CAN bus data set, wherein the CAN bus data set comprises various state data of CAN frames on a CAN bus at various moments and corresponding fault information;
constructing a cyclic neural network model, and training the cyclic neural network model by utilizing the CAN bus data set;
the step of training the recurrent neural network model by using the CAN bus data set comprises the following steps: randomly dividing the CAN bus data set into training set data and verification set data according to a K-Fold method; training the cyclic neural network model by utilizing the training set data, and adaptively adjusting the super parameters in the cyclic neural network model; verifying the trained cyclic neural network model by using the verification set data;
the training the recurrent neural network model by using the training set data comprises the following steps: respectively inputting various state data and corresponding time sequences in the training set data into the cyclic neural network model, and outputting corresponding fault occurrence probability; according to fault information at each moment in the training set data and the fault occurrence probability, the super parameters of the neural network model are adaptively adjusted;
and inputting various state data of the current CAN frame on the CAN bus into the trained cyclic neural network model, and acquiring the current fault occurrence probability output by the cyclic neural network model.
2. The in-vehicle network failure detection method according to claim 1, characterized in that the step of acquiring the CAN bus data set includes:
and acquiring CAN frames on the CAN bus at each moment, and respectively serializing according to frame types to obtain various state data, wherein each type of state data comprises frame start data, arbitration field data, control field data, data field data, CRC field data, ACK field data and frame end data.
3. The method for detecting a fault in an on-vehicle network according to claim 1, wherein the step of obtaining the current probability of occurrence of the fault output by the recurrent neural network model further comprises:
judging whether the fault occurrence probability is larger than a threshold value or not;
if yes, pushing alarm information to a preset feed.
4. The vehicle network fault detection method according to claim 1, wherein the recurrent neural network model adopts a logistic regression function as an output layer and adopts an Adam algorithm as an optimization algorithm of model parameters.
5. The vehicle network fault detection method according to claim 1, wherein the recurrent neural network model adopts a GRU recurrent neural network model.
6. An in-vehicle network failure detection apparatus, characterized by comprising:
the acquisition module is used for acquiring a CAN bus data set, wherein the CAN bus data set comprises various state data of CAN frames on a CAN bus at various moments and corresponding fault information;
the model training module is used for constructing a cyclic neural network model and training the cyclic neural network model by utilizing the CAN bus data set;
the model training module is specifically used for: randomly dividing the CAN bus data set into training set data and verification set data according to a K-Fold method; training the cyclic neural network model by utilizing the training set data, and adaptively adjusting the super parameters in the cyclic neural network model; verifying the trained cyclic neural network model by using the verification set data;
the model training module is specifically used for: respectively inputting various state data and corresponding time sequences in the training set data into the cyclic neural network model, and outputting corresponding fault occurrence probability; according to fault information at each moment in the training set data and the fault occurrence probability, the super parameters of the neural network model are adaptively adjusted;
the model test module is used for inputting various state data of the current CAN frame on the CAN bus into the trained cyclic neural network model and obtaining the current fault occurrence probability output by the cyclic neural network model.
7. A readable storage medium having stored thereon a program, which when executed by a processor, implements the method according to any of claims 1-5.
8. An electronic device comprising a memory, a processor and a program stored on the memory and executable on the processor, wherein the processor implements the method of any one of claims 1-5 when the program is executed by the processor.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110934136.XA CN113660137B (en) | 2021-08-13 | 2021-08-13 | Vehicle-mounted network fault detection method and device, readable storage medium and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110934136.XA CN113660137B (en) | 2021-08-13 | 2021-08-13 | Vehicle-mounted network fault detection method and device, readable storage medium and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113660137A CN113660137A (en) | 2021-11-16 |
| CN113660137B true CN113660137B (en) | 2024-03-22 |
Family
ID=78480318
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110934136.XA Active CN113660137B (en) | 2021-08-13 | 2021-08-13 | Vehicle-mounted network fault detection method and device, readable storage medium and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113660137B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113992533B (en) * | 2021-12-29 | 2022-03-22 | 湖南大学 | Vehicle-mounted CAN bus data anomaly detection and identification method |
| CN114710372B (en) * | 2022-06-08 | 2022-09-06 | 湖南师范大学 | Vehicle-mounted CAN network intrusion detection system and method based on incremental learning |
| CN115489537A (en) * | 2022-11-01 | 2022-12-20 | 成都工业职业技术学院 | Information security testing method, system and storage medium for intelligent networked automobile |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108898238A (en) * | 2018-05-24 | 2018-11-27 | 沈阳东软医疗系统有限公司 | Medical equipment failure forecasting system and correlation technique, device and equipment |
| CN108965001A (en) * | 2018-07-12 | 2018-12-07 | 北京航空航天大学 | A kind of appraisal procedure and device of vehicle message data model |
| CN110737732A (en) * | 2019-10-25 | 2020-01-31 | 广西交通科学研究院有限公司 | electromechanical equipment fault early warning method |
| CN111598322A (en) * | 2020-05-09 | 2020-08-28 | 东软医疗系统股份有限公司 | Medical equipment fault prediction method, device, medium and electronic equipment |
| CN112785016A (en) * | 2021-02-20 | 2021-05-11 | 南京领行科技股份有限公司 | New energy automobile maintenance and fault monitoring and diagnosis method based on machine learning |
| CN112906969A (en) * | 2021-03-01 | 2021-06-04 | 三一重工股份有限公司 | Engine fault prediction method, engine fault prediction device, electronic equipment and storage medium |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112015603A (en) * | 2019-05-30 | 2020-12-01 | 鸿富锦精密电子(郑州)有限公司 | User terminal hardware detection method, device, computer device and storage medium |
-
2021
- 2021-08-13 CN CN202110934136.XA patent/CN113660137B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108898238A (en) * | 2018-05-24 | 2018-11-27 | 沈阳东软医疗系统有限公司 | Medical equipment failure forecasting system and correlation technique, device and equipment |
| CN108965001A (en) * | 2018-07-12 | 2018-12-07 | 北京航空航天大学 | A kind of appraisal procedure and device of vehicle message data model |
| CN110737732A (en) * | 2019-10-25 | 2020-01-31 | 广西交通科学研究院有限公司 | electromechanical equipment fault early warning method |
| CN111598322A (en) * | 2020-05-09 | 2020-08-28 | 东软医疗系统股份有限公司 | Medical equipment fault prediction method, device, medium and electronic equipment |
| CN112785016A (en) * | 2021-02-20 | 2021-05-11 | 南京领行科技股份有限公司 | New energy automobile maintenance and fault monitoring and diagnosis method based on machine learning |
| CN112906969A (en) * | 2021-03-01 | 2021-06-04 | 三一重工股份有限公司 | Engine fault prediction method, engine fault prediction device, electronic equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113660137A (en) | 2021-11-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN113660137B (en) | Vehicle-mounted network fault detection method and device, readable storage medium and electronic equipment | |
| US20220350888A1 (en) | Methods and arrangements for multi-layer in-vehicle network intrusion detection and characterization | |
| US20190312892A1 (en) | Onboard cybersecurity diagnostic system for vehicle, electronic control unit, and operating method thereof | |
| CN106650505A (en) | Vehicle attack detection method and device | |
| US20210344700A1 (en) | Vehicle security monitoring apparatus, method and non-transitory computer readable medium | |
| US20200145433A1 (en) | Methods and arrangements for message time series intrusion detection for in-vehicle network security | |
| US8676432B2 (en) | Fault prediction framework using temporal data mining | |
| US11928006B2 (en) | System and method for labeling bits of controller area network (CAN) messages | |
| US20120245791A1 (en) | Apparatus and method for predicting mixed problems with vehicle | |
| CN109163913A (en) | A kind of Diagnosis method of automobile faults and relevant device | |
| JP4401356B2 (en) | Method for identifying cause of decrease in frequency of performing abnormality detection and method of improving frequency of performing abnormality detection | |
| CN114374565A (en) | Intrusion detection method and device for vehicle CAN network, electronic equipment and medium | |
| US11768129B2 (en) | Machine-learning based vehicle diagnostics and maintenance | |
| DE102020215586A1 (en) | A SYSTEM AND PROCEDURE FOR NETWORK INTRUSION DETECTION BASED ON PHYSICAL MEASUREMENTS | |
| US20070136015A1 (en) | Diagnosis apparatus for diagnosing state of equipment | |
| CN105658937A (en) | Method for monitoring operation of sensor | |
| US20220400125A1 (en) | Using staged machine learning to enhance vehicles cybersecurity | |
| Tanksale | Design of anomaly detection functions for controller area networks | |
| CN112606779B (en) | Automobile fault early warning method and electronic equipment | |
| WO2022040360A1 (en) | Detecting vehicle malfunctions and cyber attacks using machine learning | |
| US20220385544A1 (en) | Early detection of cable failure in automotive networks | |
| EP4095533A2 (en) | Early detection of cable failure in automotive networks | |
| Zhang et al. | Accelerating in-vehicle network intrusion detection system using binarized neural network | |
| JP7273875B2 (en) | Determination device, moving body, determination method and program | |
| US20210184890A1 (en) | Apparatus and Method for Diagnosing Sleep of CAN for Vehicle |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |