CN116580176A - Vehicle-mounted CAN bus anomaly detection method based on lightweight network MobileViT - Google Patents
Vehicle-mounted CAN bus anomaly detection method based on lightweight network MobileViT Download PDFInfo
- Publication number
- CN116580176A CN116580176A CN202310706777.9A CN202310706777A CN116580176A CN 116580176 A CN116580176 A CN 116580176A CN 202310706777 A CN202310706777 A CN 202310706777A CN 116580176 A CN116580176 A CN 116580176A
- Authority
- CN
- China
- Prior art keywords
- vehicle
- bus
- model
- mobilevit
- abnormality detection
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 79
- 230000005856 abnormality Effects 0.000 claims abstract description 62
- 230000006399 behavior Effects 0.000 claims abstract description 58
- 238000012549 training Methods 0.000 claims abstract description 49
- 230000006870 function Effects 0.000 claims abstract description 31
- 238000000034 method Methods 0.000 claims abstract description 27
- 238000004140 cleaning Methods 0.000 claims abstract description 7
- 238000006243 chemical reaction Methods 0.000 claims abstract description 5
- 238000012360 testing method Methods 0.000 claims description 14
- 230000004913 activation Effects 0.000 claims description 11
- 239000011159 matrix material Substances 0.000 claims description 9
- 230000004927 fusion Effects 0.000 claims description 6
- 238000007781 pre-processing Methods 0.000 claims description 6
- 238000011156 evaluation Methods 0.000 claims description 5
- 238000011176 pooling Methods 0.000 claims description 4
- 230000000694 effects Effects 0.000 claims description 3
- 238000011478 gradient descent method Methods 0.000 claims description 3
- 238000005457 optimization Methods 0.000 claims description 3
- 238000005070 sampling Methods 0.000 claims description 3
- 238000003825 pressing Methods 0.000 claims 1
- 230000008569 process Effects 0.000 abstract description 5
- 230000016273 neuron death Effects 0.000 abstract description 3
- 230000003213 activating effect Effects 0.000 abstract description 2
- 230000002159 abnormal effect Effects 0.000 description 6
- 238000013527 convolutional neural network Methods 0.000 description 5
- 238000013135 deep learning Methods 0.000 description 5
- 230000004044 response Effects 0.000 description 5
- 238000009826 distribution Methods 0.000 description 4
- 238000004364 calculation method Methods 0.000 description 3
- 230000007547 defect Effects 0.000 description 3
- 238000010586 diagram Methods 0.000 description 3
- 238000002474 experimental method Methods 0.000 description 3
- 238000000605 extraction Methods 0.000 description 3
- 230000007246 mechanism Effects 0.000 description 3
- 230000003542 behavioural effect Effects 0.000 description 2
- 238000013507 mapping Methods 0.000 description 2
- 238000011160 research Methods 0.000 description 2
- 206010000117 Abnormal behaviour Diseases 0.000 description 1
- 206010001488 Aggression Diseases 0.000 description 1
- 230000009471 action Effects 0.000 description 1
- 208000012761 aggressive behavior Diseases 0.000 description 1
- 230000016571 aggressive behavior Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000000052 comparative effect Effects 0.000 description 1
- 238000011423 initialization method Methods 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000003058 natural language processing Methods 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000009827 uniform distribution Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V10/00—Arrangements for image or video recognition or understanding
- G06V10/20—Image preprocessing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/0464—Convolutional networks [CNN, ConvNet]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/048—Activation functions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
- G06N3/084—Backpropagation, e.g. using gradient descent
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V10/00—Arrangements for image or video recognition or understanding
- G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
- G06V10/77—Processing image or video features in feature spaces; using data integration or data reduction, e.g. principal component analysis [PCA] or independent component analysis [ICA] or self-organising maps [SOM]; Blind source separation
- G06V10/774—Generating sets of training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V10/00—Arrangements for image or video recognition or understanding
- G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
- G06V10/82—Arrangements for image or video recognition or understanding using pattern recognition or machine learning using neural networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/40—Bus networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/40—Bus networks
- H04L2012/40208—Bus networks characterized by the use of a particular bus standard
- H04L2012/40215—Controller Area Network CAN
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02T—CLIMATE CHANGE MITIGATION TECHNOLOGIES RELATED TO TRANSPORTATION
- Y02T10/00—Road transport of goods or passengers
- Y02T10/10—Internal combustion engine [ICE] based vehicles
- Y02T10/40—Engine management systems
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Evolutionary Computation (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Artificial Intelligence (AREA)
- Software Systems (AREA)
- Computing Systems (AREA)
- General Health & Medical Sciences (AREA)
- Data Mining & Analysis (AREA)
- Computational Linguistics (AREA)
- Mathematical Physics (AREA)
- General Engineering & Computer Science (AREA)
- Life Sciences & Earth Sciences (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Molecular Biology (AREA)
- Multimedia (AREA)
- Databases & Information Systems (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Medical Informatics (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Traffic Control Systems (AREA)
Abstract
The invention provides a vehicle-mounted CAN bus abnormality detection method based on a lightweight network MobileViT, and relates to the field of network and information security. Obtaining a behavior sample picture dataset by carrying out data cleaning and dimension conversion on an original dataset; an improved lightweight network model MobileViT is constructed and trained to realize the classification of the generated behavior sample pictures, so that the problem of vehicle-mounted CAN bus anomaly detection is converted into the problem of picture classification. The GELU is used as an activating function of the MV2 module in the lightweight MobileViT network model, so that the problem of neuronal death is effectively solved, and the convergence rate of the model is improved; in the training process of the model, the learning rate is automatically updated by exponential decay, so that the training time is reduced while the model is prevented from falling into local optimum. According to the invention, the lightweight network MobileViT is applied to the abnormality detection of the vehicle-mounted CAN bus for the first time, and the abnormality of the vehicle-mounted CAN bus CAN be efficiently detected under the condition of consuming less hardware resources.
Description
Technical Field
The invention belongs to the field of network and information security, and particularly relates to a vehicle-mounted CAN bus abnormality detection method based on a lightweight network MobileViT.
Background
Currently, an abnormality of a vehicle-mounted CAN (Controller Area Network ) bus is one of the major threats of the internet of vehicles. The abnormal vehicle-mounted CAN bus refers to the situation that a hacker attacks the vehicle-mounted CAN bus by using illegal technical means under the condition that a driver is unknown or not allowed by the driver in the normal running of the vehicle, so that the vehicle-mounted CAN bus is abnormal. The vehicle-mounted CAN bus abnormality detection aims at identifying all data passing through the vehicle-mounted CAN bus so as to prevent the vehicle-mounted CAN bus abnormality and further cause greater harm to driving safety.
The traditional vehicle-mounted CAN bus abnormality detection method comprises a vehicle-mounted CAN bus abnormality detection method based on information entropy and a vehicle-mounted CAN bus abnormality detection method based on information feature classification. The vehicle-mounted CAN bus abnormality detection method based on the information entropy is characterized in that the information entropy of the vehicle-mounted CAN bus under normal conditions is calculated and calibrated as a datum line for abnormality detection, the information entropy of the vehicle-mounted CAN bus on each time slice is calculated, and the calculated information entropy of the vehicle-mounted CAN bus is compared with the datum line, so that whether the vehicle-mounted CAN bus is abnormal or not is judged. The vehicle-mounted CAN bus anomaly detection based on the information entropy has the defect that a datum line is difficult to define, and a slightly higher or lower datum line has great influence on the accuracy of a detection result. The vehicle-mounted CAN bus abnormality detection method based on information feature classification is characterized in that key features of abnormality behavior easy to calculate are selected as the basis of vehicle-mounted CAN bus abnormality detection aiming at the abnormality behavior generated after the vehicle-mounted CAN bus is attacked, and the method has the defect that key features of certain abnormality behaviors are difficult to calculate, so that all abnormality of the vehicle-mounted CAN bus cannot be detected. In addition, the vehicle-mounted CAN bus abnormality detection method based on information entropy and information feature classification needs to perform complex calculation, and consumes a large amount of hardware resources.
In view of successful application of deep learning in various fields such as image processing, voice recognition, natural language processing and the like, the research of the vehicle-mounted CAN bus anomaly detection method based on the deep learning also becomes a research hotspot in the current network and information security fields. Javed et al combine convolutional neural network with the gating circulation unit that fuses attention mechanism, constructed the abnormal detection model of vehicle-mounted CAN bus, and test on the true vehicle-mounted CAN bus of collection, CAN discern the unusual action finally. The obvious disadvantage of the method is that the model is complex and huge, and is difficult to deploy on the vehicle-mounted CAN bus. Lo et al propose an intrusion detection method based on convolutional neural network and long-short-term memory network, utilize convolutional neural network to characteristic extraction ability and long-short-term memory network to adaptability of time sequence data, carry on the experiment on the actual vehicle CAN bus, the experiment shows that this method compares with traditional machine learning method, have a great deal of promotion in detection accuracy and false alarm rate index. But there are problems in that the convergence speed of model training is too slow and the response time is too long.
In summary, the existing vehicle-mounted CAN bus abnormality detection methods based on deep learning have certain detection capability, but the problems of bulky model, numerous parameters, slower convergence speed, overlong response time and the like often exist.
Disclosure of Invention
Aiming at the defects of the prior art, the invention provides a vehicle-mounted CAN bus abnormality detection method based on a lightweight network MobileViT.
In order to solve the technical problems, the invention adopts the following technical scheme:
step 1: acquiring an original data set, preprocessing a behavior flow sample in the original data set, converting the behavior flow sample into a corresponding behavior sample picture, obtaining a picture data set, and dividing the picture data set into a training set and a testing set;
step 2: building a lightweight network model MobileViT, inputting a training set, initializing network parameters of the training set to obtain an initial vehicle-mounted CAN bus anomaly detection model, and performing super-parameter optimization;
step 3: training an initial vehicle-mounted CAN bus abnormality detection model to obtain a trained vehicle-mounted CAN bus abnormality detection model;
step 4: the F1 score F1-score, the Precision, the Recall ratio Recall and the Accuracy Accuracy are adopted as evaluation indexes, a test set is utilized to evaluate the trained vehicle-mounted CAN bus abnormality detection model, the obtained index result is compared with the index of the existing model, and the detection effect of the vehicle-mounted CAN bus abnormality detection model is verified.
Further, the step 1 includes:
step 1.1: acquiring a Car-Hacking Dataset as an original Dataset;
step 1.2: preprocessing a behavior traffic sample in an original data set: performing data cleaning and dimension conversion on the original data set, and converting the behavior flow sample into a corresponding behavior sample picture;
step 1.3: and generating a picture data set according to the pre-processed behavior sample picture, and randomly dividing the picture data set into a training set and a testing set according to 8:2.
Further, the step 2 includes:
step 2.1: the method for constructing the lightweight network model MobileViT comprises the following steps of: the system comprises a convolution layer, an MV2 module, an MVIT module, a global pooling layer and a full connection layer;
further, the step 2.1 further includes:
the MV2 module is an inverted residual structure, comprising: the convolution layer with the convolution kernel size of 1 multiplied by 1, the activation function layer is a GELU function, the convolution kernel size of 3 multiplied by 3 is a depth separable convolution layer, the activation function layer is a GELU function, the convolution kernel size of 1 multiplied by 1 is a linear activation function; the inverted residual structure can be connected by a Shortcut only when the Stride is 1 and the shape of the input feature matrix is the same as that of the output feature matrix;
the MVIT module consists of three functional submodules, namely a local feature modeling module, a global feature modeling module and a feature fusion module; wherein: the local feature modeling module comprises a convolution layer with a convolution kernel of 3 multiplied by 3 and a convolution layer with a convolution kernel size of 1 multiplied by 1; the global feature modeling module is a Unfold- > transducer- > Fold structure; the feature fusion module comprises a convolution layer with a convolution kernel size of 1 multiplied by 1, splicing operation and a convolution layer with a convolution kernel size of 3 multiplied by 3;
step 2.2: inputting a training set, initializing a lightweight network model MobileViT to obtain an initial vehicle-mounted CAN bus anomaly detection model, and obtaining super parameters after model initialization;
step 2.3: automatically updating the learning rate by using an exponential decay algorithm, training the hyper-parameters after the initialization of the update model, and optimizing the initial vehicle-mounted CAN bus abnormality detection model, wherein the principle of the exponential decay algorithm is as follows:
lr t ＝lr×gamma epoch
where lr represents the initial learning rate; lr (lr) t Representing a current learning rate; gamma represents the learning rate attenuation factor, i.e. the bottom of the learning rate adjustment multiple; epoch represents the training round.
Further, the step 3 includes:
step 3.1: inputting the divided training set into an optimized initial vehicle-mounted CAN bus abnormality detection model;
step 3.2: training based on the error of the loss function calculation using a random gradient descent method, sampling the data samples uniformly with an index m, m e {1, …, n } at each iteration of the random gradient descent, and calculating the gradientUpdating x to obtain a trained vehicle-mounted CAN bus abnormality detection model, wherein the formula is as follows:
wherein f m (x) Is a loss function of training samples with respect to index mWhere x is the parameter vector, and where,f m (x) Gradient as objective function, eta as learning rate;
compared with the prior art, the technical scheme provided by the invention has the following beneficial effects:
(1) The improved lightweight mobile ViT network model is utilized to classify the behavior sample pictures generated based on the Car-Hacking Dataset data set, so that the problem of abnormal detection of the vehicle-mounted CAN bus is converted into the problem of picture classification, the abnormal behavior is detected, the efficient identification of the behavior traffic samples is realized, a large amount of computing resources are not consumed in the abnormal detection of the vehicle-mounted CAN bus, the detection efficiency is improved, and the method is very suitable for application scenes with poor computing power such as the Internet of vehicles.
(2) The invention applies the lightweight network model MobileViT to the abnormality detection of the vehicle-mounted CAN bus for the first time. The MVIT module in the lightweight network model MobileViT can realize the function of fully extracting image information by using only a small amount of parameters; the MV2 module is an inverse residual structure, and the depth separable convolution can greatly reduce the operand and the parameter number and keep the depth of the feature matrix unchanged. In addition, the GELU is used for replacing the conventional ReLU6 in the MV2 module as an activation function of the module, so that the problem of neuronal death is effectively solved, and the convergence rate of the model is improved; in the training process of the model, the learning rate is automatically updated by exponential decay, so that the training time is reduced while the model is prevented from falling into local optimum. The method solves the problems of bulkiness, numerous parameters, overlong response time and the like of the vehicle-mounted CAN bus abnormality detection model based on the deep learning method, and CAN efficiently detect the abnormality of the vehicle-mounted CAN bus under the condition of consuming less hardware resources.
Drawings
For a clearer description of the embodiments of the present invention, the accompanying drawings referred to in the embodiments will be briefly described below, which are merely preferred embodiments of the present invention, and other drawings may be obtained from these drawings by those skilled in the art without inventive changes.
Fig. 1 is a flow chart of a vehicle-mounted CAN bus anomaly detection method based on a lightweight network MobileViT in the present embodiment;
fig. 2 is a schematic structural diagram of a lightweight network MobileViT in the present embodiment;
fig. 3 is a schematic structural diagram of the MV2 module in the present embodiment; (a) MV2 module with shortcut; (b) MV2 module without shortcut;
FIG. 4 is a graph of a behavior sample generated based on the Car-hanging Dataset in the present embodiment; (a) Normal generated pictures based on Normal behavior; (b) Spoofing RPM-Spoofing generated pictures based on rotational speed; (c) Spoofing Gear-spafing generated pictures based on Gear; (d) pictures generated based on denial of service attacks DoS; (e) pictures generated based on fuzzy attack fuzzy;
fig. 5 is a schematic structural diagram of an MVIT module in this embodiment.
Detailed Description
The following describes in further detail the embodiments of the present invention with reference to the drawings and examples. The following examples are illustrative of the invention and are not intended to limit the scope of the invention.
The core idea of the invention is as follows: the method comprises the steps of performing data cleaning and dimension conversion on a Car-Hacking Dataset data set, converting one normal behavior and four aggressive behaviors in the Car-Hacking Dataset data set into corresponding behavior sample pictures, obtaining a behavior sample picture data set, and dividing the behavior sample picture data set into a training set and a testing set; and constructing and training an improved lightweight network model MobileViT by using the divided behavior sample picture data set to realize classification of the behavior sample picture generated based on the Car-Hacking Dataset, so that the problem of vehicle-mounted CAN bus abnormality detection is converted into the problem of picture classification, and the purpose of detecting the vehicle-mounted CAN bus abnormality is achieved. The MVIT module in the lightweight network model MobileViT can realize the function of fully extracting image information by using only a small amount of parameters; the MV2 module is an inverse residual structure, and the depth separable convolution can greatly reduce the operand and the parameter number and keep the depth of the feature matrix unchanged. The improved lightweight MobileViT network model fuses the outstanding capability of a convolutional neural network for feature extraction and a multi-head attention mechanism in a transducer, so that the network model can capture different features and modes in input data in parallel; by improving the activation function of the MV2 module in the lightweight MobileViT network model and using the GELU to replace the conventional ReLU6 in the MV2 module, the problem of neuronal death is effectively solved, and the convergence rate of the model is improved; in the training process of the model, the learning rate is automatically updated by exponential decay, so that the training time is reduced while the model is prevented from falling into local optimum. According to the invention, the lightweight network MobileViT is applied to the abnormality detection of the vehicle-mounted CAN bus for the first time, and the abnormality of the vehicle-mounted CAN bus CAN be efficiently detected under the condition of consuming less hardware resources.
As shown in fig. 1, the embodiment provides a vehicle-mounted CAN bus anomaly detection method based on a lightweight network MobileViT, which includes the following steps:
step 1: acquiring an original data set, preprocessing a behavior flow sample in the original data set, converting the behavior flow sample into a corresponding behavior sample picture, obtaining a picture data set, and dividing the picture data set into a training set and a testing set;
step 1.1: acquiring a Car-Hacking Dataset as an original Dataset;
in the present example, a Car-stacking Dataset constructed based on a real vehicle environment provided by the HCRL laboratory of korea Gao Lida was obtained, the specific behavior traffic sample types and numbers of which are shown in table 1;
TABLE 1Car-Hacking Dataset
Step 1.2: preprocessing a behavior flow sample in an original data set, cleaning the original data, converting dimensions, and converting the behavior flow sample into a corresponding behavior sample picture;
step 1.3: and generating a picture data set according to the pre-processed behavior sample picture, and randomly dividing the picture data set into a training set and a testing set according to 8:2.
In this embodiment, a behavioral traffic sample of the Car-stacking Dataset is preprocessed: firstly, carrying out data cleaning on a Car-Hacking data set, and removing dirty data in the Car-Hacking data set; then, performing data conversion by using a quantile normalization method, and converting the behavior flow sample subjected to data cleaning into a range of 0-255; based on the feature size and the time stamp of the behavior flow sample, converting the behavior flow sample converted into a range of 0-255 into a color behavior sample picture with 3 channels, as shown in fig. 4; finally, establishing a mapping relation between the behavior flow samples and the behavior sample pictures, wherein 5 behavior flow samples correspond to 5 behavior sample pictures and are marked by numbers 0-4, and the mapping relation between the 5 behavior flow samples and the 5 behavior sample pictures is shown in a table 2;
TABLE 2 correspondence between behavioral flow samples and numbers
After the pretreatment, each behavior flow sample in the obtained Car-hanging Dataset data set is converted into a corresponding behavior sample picture with a specific pattern, and a picture data set is generated according to the behavior pattern picture, namely, the problem of vehicle-mounted CAN bus abnormality detection is converted into a picture classification problem, so that the complexity of the problem is simplified.
Step 2: building a lightweight network model MobileViT, inputting a training set, initializing network parameters of the training set to obtain an initial vehicle-mounted CAN bus anomaly detection model, and performing super-parameter optimization;
step 2.1: constructing a lightweight network model MobileViT;
in this embodiment, the constructed lightweight network model MobileViT, as shown in fig. 2, merges the salient capability of the convolutional neural network on feature extraction and the multi-head attention mechanism in the transform, and its structure includes: a convolution layer, an MV2 module, an MViT module, a global pooling layer and a full connection layer;
in this embodiment, as shown in fig. 3, the MV2 module structure is an inverse residual structure, and the feature map, that is, the output of the input behavior sample picture obtained by the previous module, is activated by a convolution layer with a convolution kernel size of 1×1 and by using a GELU function, and then the convolution operation is performed by using a depth separable convolution layer with a convolution kernel size of 3×3, and the feature matrix depth is kept unchanged by using the GELU function activation, unlike the conventional convolution, the depth separable convolution can greatly reduce the operation amount and the parameter number; finally, activating by using a linear activation function through a convolution layer with a convolution kernel size of 1 multiplied by 1; the inverted residual structure can be connected by shortcuts only when the Stride is 1 and the input feature matrix and the output feature matrix have the same shape;
in this embodiment, the structure of the MobileViT module, as shown in fig. 5, is composed of three functional sub-modules, which are a local feature modeling module, a global feature modeling module, and a feature fusion module, respectively; firstly, carrying out local feature modeling on the feature map by a local feature modeling module through a convolution layer with a convolution kernel of 3 multiplied by 3, and adjusting the channel number by following a convolution layer with a convolution kernel of 1 multiplied by 1; then carrying out global feature modeling through a Unfold- > transducer- > Fold structure of a global feature modeling module, and adjusting the number of channels to an initial size along with a convolution layer with a convolution kernel size of 1×1; then splicing the original input feature images along the channel direction through Shortcut branches; finally, performing feature fusion through a convolution layer with the convolution kernel size of 3 multiplied by 3 to obtain output; the module can fully extract the image characteristic information by using fewer parameters;
in this embodiment, after the training set data is input to the MobileViT model, the operation performed by the passing module and the number of output channels are shown in table 3;
TABLE 3MobileViT model details
Wherein input represents the data input size; the operator represents what kind of operation module is performed on the data; out represents the number of output channels passing through the operation module; l represents the number of transducer modules in the MVIT module; s represents the step size of the operation; conv represents a convolution operation; MV2 represents a MobileNet V2 module, MVIT represents a MobileViT module; avgpool8×8 represents an average pooling layer of size 8×8; FC stands for fully connected layer.
Step 2.2: inputting a training set, initializing a lightweight network model MobileViT to obtain an initial vehicle-mounted CAN bus anomaly detection model, and obtaining super parameters after model initialization;
in this embodiment, the network parameter initialization method is an Xavier method, which is used to ensure that the variance of each layer is consistent during forward propagation and reverse propagation, and the variance of the activation value of each layer remains unchanged during forward propagation; the variance of the gradient values for each layer remains the same during back propagation. Determining a distribution range of parameter random initialization according to the input number and the output number of each layer, wherein the distribution range is uniform distribution in the distribution range obtained by the input and output parameter numbers of the layer; in order to make the variance of each layer as equal as possible and make the information in the network flow better, the method initializes the weight of each layer to be uniformly distributed within the following range, and the formula is as follows:
wherein W-U represent symmetrical intervals and are uniformly distributed; n is n j Indicating that the j-th layer is convolved with n parameters;
step 2.3: automatically updating the learning rate by using an exponential decay algorithm, training the hyper-parameters after model initialization, and optimizing an initial vehicle-mounted CAN bus abnormality detection model, wherein the principle of the exponential decay algorithm is as follows:
lr t ＝lr×gamma epoch
where lr represents the initial learning rate; lr (lr) t Representing a current learning rate; gamma represents the learning rate attenuation factor, i.e. the bottom of the learning rate adjustment multiple; epoch represents the training round;
by using the learning rate updating strategy, the training speed of the model is ensured, the phenomenon that the learning rate is excessively set in the initial stage of model training and oscillates at a standing point in the gradient descending process is prevented, and the model is prevented from converging to local optimum due to the excessively small learning rate at the beginning.
Step 3: training an initial vehicle-mounted CAN bus abnormality detection model to obtain a trained vehicle-mounted CAN bus abnormality detection model;
step 3.1: inputting the divided training set into an optimized initial vehicle-mounted CAN bus abnormality detection model;
step 3.2: training based on the error of the loss function calculation using a random gradient descent method, sampling the data samples uniformly with an index m, m e {1, …, n } at each iteration of the random gradient descent, and calculating the gradientUpdating x to obtain a trained vehicle-mounted CAN bus abnormality detection model, wherein the formula is as follows:
wherein f m (x) Is a loss function for training samples with respect to index m, where x is a parameter vector,f m (x) Being the gradient of the objective function, η is the learning rate.
In this embodiment, the cross entropy loss function is selected to measure the error between the classification result and the actual result of the behavior sample picture in the training process, and is a non-negative function, the smaller the loss function is, the better the robustness of the model is, and the cross entropy loss function is represented as follows:
wherein p is i Representing a probability distribution, i=0, 1, …, c-1, each element p i Representing the probability that the sample belongs to the i-th behavior sample picture; y is i Vector form representation representing the tag, i=0, 1, …, c-1, y when the behavior sample picture belongs to class i i =1, otherwise y i =0; c represents the label of the behavior sample picture.
Step 4: the method comprises the steps of adopting an F1 score, an Accuracy Precision, a Recall ratio Recall and an Accuracy Accuracy as evaluation indexes, evaluating a trained vehicle-mounted CAN bus abnormality detection model by using a test set, comparing an obtained index result with an index of an existing model, and verifying the detection effect of the vehicle-mounted CAN bus abnormality detection model;
in this embodiment, the F1 score, precision, recall, and Accuracy, which are recognized in the field, are adopted as evaluation indexes, and the Accuracy of each model is evaluated by comparing the Accuracy values of each model using the Accuracy indexes. And (3) evaluating the stability of each model by comparing how much of all the true values of each model are correct data and predicting the accuracy by using the recall index. And evaluating the robustness of each model by comparing the fact that the true value is the correct proportion in the data predicted to be correct by using the precision index. The F1 score index is utilized, and the performance of the second classification of each model is evaluated by comparing the proportion of the normal behavior flow and the attack behavior flow to be correctly classified by each model;
in addition, in the embodiment, three indexes of parameter quantity, training time and test time are compared, the parameter quantity of each model is compared to evaluate the size of the trained vehicle-mounted CAN bus abnormality detection model, and the training time and the test time of each model are compared to evaluate the detection efficiency of the vehicle-mounted CAN bus abnormality detection model;
in this example, to verify the effectiveness of the method of the present invention, VGG16, inception, xception, resNet, vision-transducer were used to represent a complex network model, and ShuffleNetV2, mobileNetV3, mobileViT, and modified network model MobileViT were used to represent a lightweight network model, and comparative experiments were performed, the experimental results of which are shown in table 4;
table 4 Experimental results of evaluation of vehicle-mounted CAN bus abnormality detection model
The following conclusion CAN be obtained through experimental results, the parameter quantity of the improved vehicle-mounted CAN bus abnormality detection model provided by the embodiment is minimum, only 2.12M, the shortest test time represents quick response, and the detection accuracy is the same as that of the complex model, so that the method is suitable for abnormality detection of the vehicle-mounted CAN bus.
In conclusion, the method and the device realize efficient identification of the behavior flow samples, and solve the problems that the vehicle-mounted CAN bus abnormality detection model is in a state of being bloated, numerous in parameters, too long in response time and the like under the existing deep learning method. In addition, the lightweight network MobileViT is applied to anomaly detection of the vehicle-mounted CAN bus for the first time, the size of the model after training is only 2.12M, and the model is easy to deploy on low-power platforms such as the Internet of vehicles.
Finally, it should be noted that: the above embodiments are only for illustrating the technical solution of the present invention, and are not limiting; although the invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art will understand that; the technical scheme described in the foregoing embodiments can be modified or some or all of the technical features thereof can be replaced with equivalents; such modifications and substitutions do not depart from the spirit of the invention, which is defined by the following claims.
Claims (6)
1. A vehicle-mounted CAN bus abnormality detection method based on a lightweight network MobileViT is characterized by comprising the following steps of: the method comprises the following steps:
step 1: acquiring an original data set, preprocessing a behavior flow sample in the original data set, converting the behavior flow sample into a corresponding behavior sample picture, obtaining a picture data set, and dividing the picture data set into a training set and a testing set;
step 2: building a lightweight network model MobileViT, inputting a training set, initializing network parameters of the training set to obtain an initial vehicle-mounted CAN bus anomaly detection model, and performing super-parameter optimization;
step 3: training an initial vehicle-mounted CAN bus abnormality detection model to obtain a trained vehicle-mounted CAN bus abnormality detection model;
step 4: the F1 score F1-score, the Precision, the Recall ratio Recall and the Accuracy Accuracy are adopted as evaluation indexes, a test set is utilized to evaluate the trained vehicle-mounted CAN bus abnormality detection model, the obtained index result is compared with the index of the existing model, and the detection effect of the vehicle-mounted CAN bus abnormality detection model is verified.
2. The vehicle-mounted CAN bus abnormality detection method based on the lightweight network MobileViT as claimed in claim 1, wherein the method comprises the following steps: the step 1 comprises the following steps:
step 1.1: acquiring a Car-Hacking Dataset as an original Dataset;
step 1.2: preprocessing a behavior traffic sample in an original data set: performing data cleaning and dimension conversion on the original data set, and converting the behavior flow sample into a corresponding behavior sample picture;
step 1.3: generating a picture data set according to the pre-processed behavior sample picture, and pressing 8:2 are randomly divided into training and test sets.
3. The vehicle-mounted CAN bus abnormality detection method based on the lightweight network MobileViT as claimed in claim 1, wherein the method comprises the following steps: the step 2 comprises the following steps:
step 2.1: the method for constructing the lightweight network model MobileViT comprises the following steps of: the system comprises a convolution layer, an MV2 module, an MVIT module, a global pooling layer and a full connection layer;
step 2.2: inputting a training set, initializing a lightweight network model MobileViT to obtain an initial vehicle-mounted CAN bus anomaly detection model, and obtaining super parameters after model initialization;
step 2.3: automatically updating the learning rate by using an exponential decay algorithm, training the hyper-parameters after the initialization of the update model, and optimizing the initial vehicle-mounted CAN bus abnormality detection model, wherein the principle of the exponential decay algorithm is as follows:
lr t ＝lr×gamma epoch
where lr represents the initial learning rate; lr (lr) t Representing a current learning rate; gamma represents the learning rate attenuation factor, i.e. the bottom of the learning rate adjustment multiple; epoch represents the training round.
4. The vehicle-mounted CAN bus abnormality detection method based on the lightweight network MobileViT as claimed in claim 3, wherein the method comprises the following steps: the MV2 module in the step 2.1 is an inverted residual structure, which includes: the convolution layer with the convolution kernel size of 1 multiplied by 1, the activation function layer is a GELU function, the convolution kernel size of 3 multiplied by 3 is a depth separable convolution layer, the activation function layer is a GELU function, the convolution kernel size of 1 multiplied by 1 is a linear activation function; the inverted residual structure can only have Shortcut connection when the Stride is 1 and the input feature matrix and the output feature matrix are identical in shape.
5. The vehicle-mounted CAN bus abnormality detection method based on the lightweight network MobileViT as claimed in claim 3, wherein the method comprises the following steps: the MVIT module in the step 2.1 consists of three functional submodules, namely a local feature modeling module, a global feature modeling module and a feature fusion module; wherein: the local feature modeling module comprises a convolution layer with a convolution kernel of 3 multiplied by 3 and a convolution layer with a convolution kernel size of 1 multiplied by 1; the global feature modeling module is a Unfold- > Transformer- > Fold structure; the feature fusion module comprises a convolution layer with a convolution kernel size of 1 multiplied by 1, splicing operation and a convolution layer with a convolution kernel size of 3 multiplied by 3.
6. The vehicle-mounted CAN bus abnormality detection method based on the lightweight network MobileViT as claimed in claim 1, wherein the method comprises the following steps: the step 3 comprises the following steps:
step 3.1: inputting the divided training set into an optimized initial vehicle-mounted CAN bus abnormality detection model;
step 3.2: training according to the error calculated by the loss function by using a random gradient descent method, uniformly sampling the data sample immediately by an index m, m epsilon { 1..the., n } in each iteration of random gradient descent, and calculating the gradientUpdating x to obtain a trained vehicle-mounted CAN bus abnormality detection model, wherein the formula is as follows:
wherein f m (x) Is a loss function for training samples with respect to index m, where x is a parameter vector,being the gradient of the objective function, η is the learning rate.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310706777.9A CN116580176A (en) | 2023-06-14 | 2023-06-14 | Vehicle-mounted CAN bus anomaly detection method based on lightweight network MobileViT |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310706777.9A CN116580176A (en) | 2023-06-14 | 2023-06-14 | Vehicle-mounted CAN bus anomaly detection method based on lightweight network MobileViT |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116580176A true CN116580176A (en) | 2023-08-11 |
Family
ID=87545329
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310706777.9A Pending CN116580176A (en) | 2023-06-14 | 2023-06-14 | Vehicle-mounted CAN bus anomaly detection method based on lightweight network MobileViT |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116580176A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117040939A (en) * | 2023-10-10 | 2023-11-10 | 长春大学 | Vehicle-mounted network intrusion detection method based on improved visual self-attention model |
-
2023
- 2023-06-14 CN CN202310706777.9A patent/CN116580176A/en active Pending
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117040939A (en) * | 2023-10-10 | 2023-11-10 | 长春大学 | Vehicle-mounted network intrusion detection method based on improved visual self-attention model |
| CN117040939B (en) * | 2023-10-10 | 2023-12-15 | 长春大学 | Vehicle-mounted network intrusion detection method based on improved visual self-attention model |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111753985B (en) | Image deep learning model testing method and device based on neuron coverage rate | |
| CN109902018B (en) | Method for acquiring test case of intelligent driving system | |
| CN106372666B (en) | A kind of target identification method and device | |
| CN109214349A (en) | A kind of object detecting method based on semantic segmentation enhancing | |
| CN110599459A (en) | Underground pipe network risk assessment cloud system based on deep learning | |
| Wang et al. | A Convolutional Neural Network‐Based Classification and Decision‐Making Model for Visible Defect Identification of High‐Speed Train Images | |
| CN116580176A (en) | Vehicle-mounted CAN bus anomaly detection method based on lightweight network MobileViT | |
| CN117011274A (en) | Automatic glass bottle detection system and method thereof | |
| CN114036531A (en) | Multi-scale code measurement-based software security vulnerability detection method | |
| CN115035334A (en) | Multi-classification change detection method and system for multi-scale fusion double-temporal remote sensing image | |
| Li et al. | Incremental learning of infrared vehicle detection method based on SSD | |
| CN112418020A (en) | Attention mechanism-based YOLOv3 illegal billboard intelligent detection method | |
| CN111832463A (en) | Deep learning-based traffic sign detection method | |
| CN111368894A (en) | FCBF feature selection method and application thereof in network intrusion detection | |
| Wu et al. | Research on asphalt pavement disease detection based on improved YOLOv5s | |
| CN116305103A (en) | Neural network model backdoor detection method based on confidence coefficient difference | |
| CN113988226B (en) | Data desensitization validity verification method and device, computer equipment and storage medium | |
| CN113239865B (en) | Deep learning-based lane line detection method | |
| Guo et al. | Application of machine learning in wire damage detection for safety procedure | |
| CN114021136A (en) | Back door attack defense system for artificial intelligence model | |
| CN113468555A (en) | Method, system and device for identifying client access behavior | |
| CN113326509B (en) | Method and device for detecting poisoning attack of deep learning model based on mutual information | |
| CN117614742B (en) | Malicious traffic detection method with enhanced honey point perception | |
| CN113032776B (en) | Feature-oriented embedded poisoning attack detection method, device and system | |
| CN118427681A (en) | Cross-working condition open-set fault diagnosis method and equipment based on self-supervision contrast learning enhancement |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |