WO2022075678A2

WO2022075678A2 - Apparatus and method for detecting abnormal symptoms of vehicle based on self-supervised learning by using pseudo normal data

Info

Publication number: WO2022075678A2
Application number: PCT/KR2021/013572
Authority: WO
Inventors: 김휘강; 송현민
Original assignee: 고려대학교 산학협력단
Priority date: 2020-10-07
Filing date: 2021-10-05
Publication date: 2022-04-14
Also published as: WO2022075678A3

Abstract

A method for detecting abnormal symptoms of a vehicle based on self-supervised learning by using pseudo normal data may comprise the steps of: obtaining normal data generated in a vehicle; preprocessing the obtained normal data; generating pseudo normal data by inputting the preprocessed normal data into a pre-trained first neural network model; training a second neural network model on the basis of the generated pseudo normal data; and detecting abnormal symptoms of the vehicle by inputting the data generated in the vehicle into the trained second neural network model.

Description

Apparatus and method for detecting vehicle anomalies based on self-supervised learning using pseudo-normal data

The present disclosure relates to a vehicle anomaly detection method, and more particularly, to a vehicle anomaly detection method based on self-supervised learning using pseudo-normal data.

Traditionally, vehicle control systems have been considered safe from intrusion because they are mechanically controlled. However, modern vehicles may be equipped with numerous electronic control devices such as ECUs (Electronic Control Units) that manage various functions of the vehicle and replace mechanical control devices. These ECUs may be interconnected to exchange various vehicle information with each other through a network called an In-vehicle Network (IVN) such as a Controller Area Network (CAN), a Local Interconnected Network (LIN), and FlexRay. In particular, CAN is well known as the de facto standard for IVN and is known to be the most distributed. However, while CAN provides an efficient and economical communication channel between ECUs, it lacks security functions and may be vulnerable from cyber threats. For example, when CAN receives a connection from a user device, since it does not require a separate authentication procedure, an external device other than the user device can also be easily connected.

Despite the need for research on security technologies to mitigate cyber threats to these vehicle systems, manufacturers do not disclose the CAN specifications of vehicles for various reasons. For this reason, some developers develop intrusion detection systems using data sets they generate themselves. However, this data set may fail to detect new types of anomalies because it is easy to acquire normal CAN traffic data, while it is difficult to acquire abnormal CAN traffic data (eg, attack data).

Therefore, there is a demand for a method for detecting anomalies in a vehicle network based on self-supervised learning that generates pseudo-normal data to detect a new type of anomaly and utilizes it.

The present disclosure has been devised in response to the above-described background technology, and an object of the present disclosure is to provide a method for detecting anomalies in a vehicle network based on self-supervised learning using pseudo-normal data.

The technical problems of the present disclosure are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

According to an embodiment of the present disclosure for solving the above-described problems, a method for detecting anomalies in a vehicle network based on self-supervised learning using pseudo-normal data is disclosed.

A vehicle abnormal symptom detection method according to an embodiment of the present disclosure for solving the above-described problems includes: obtaining normal data generated in the vehicle; pre-processing the obtained normal data; generating pseudo normal data by inputting data into a pre-trained first neural network model, training a second neural network model based on the generated pseudo normal data, and generating in the vehicle and inputting the data to the learned second neural network model to detect abnormal signs of the vehicle.

In an alternative embodiment of the vehicle anomaly detection method, the acquiring of the normal data may include acquiring controller area network (CAN) traffic data generated in a vehicle in a normal state.

In an alternative embodiment of the vehicle anomaly detection method, the pre-processing of the normal data includes extracting a CAN ID from CAN messages included in the normal data, and a CAN ID sequence based on the extracted CAN ID. (sequence) may be included.

In an alternative embodiment of the vehicle anomaly detection method, the CAN ID sequence may be expressed in hexadecimal or binary data.

In an alternative embodiment of the vehicle anomaly detection method, the generating of the pseudo-normal data includes: inputting the pre-processed normal data into the pre-trained first neural network model; and the pre-trained first neural network model. The method may include generating pseudo normal data by predicting a CAN ID that appears next to each CAN ID included in the normal data through a network model.

In an alternative embodiment of the vehicle anomaly detection method, the step of inputting the pre-processed normal data into the pre-trained first neural network model may include pre-learning the normal data including an arbitrary CAN ID or CAN ID sequence. can be input to the first neural network model.

In an alternative embodiment of the vehicle anomaly detection method, the generating of the pseudo-normal data includes: a next CAN ID according to a probability distribution of a CAN ID appearing next to each CAN ID included in the normal data. You can predict and choose.

In an alternative embodiment of the vehicle anomaly detection method, the generating of the pseudo-normal data may include adding noise by selecting an arbitrary CAN ID according to a uniform distribution when selecting the next CAN ID. there is.

In an alternative embodiment of the vehicle anomaly detection method, when adding the noise, an arbitrary CAN ID may be selected as the uniform distribution based on a preset noise ratio.

In an alternative embodiment of the vehicle anomaly detection method, the pseudo-normal data may include a CAN ID sequence having an arbitrary length.

In an alternative embodiment of the vehicle anomaly detection method, the pseudo normal data may include a CAN ID sequence having the same length as that of normal data input to the first neural network model.

In an alternative embodiment of the vehicle anomaly detection method, the pseudo-normal data includes a CAN ID sequence, and some CAN IDs are selected with a uniform distribution according to a preset noise ratio among all CAN IDs of the CAN ID sequence can be

In an alternative embodiment of the vehicle anomaly detection method, the first neural network model, when the CAN ID or CAN ID sequence extracted from the normal data is input, the CAN ID that appears next to the input CAN ID or CAN ID sequence can be pre-trained to predict the probability distribution for

In an alternative embodiment of the vehicle anomaly detection method, the prior learning of the first neural network model includes receiving the CAN ID extracted from the normal data and converting it into a vector of a certain size, based on the converted vector It may include extracting a context of a given sequence, and predicting and learning a probability distribution for a CAN ID appearing next to the input CAN ID based on the context of the extracted sequence.

In an alternative embodiment of the vehicle anomaly detection method, the first neural network model includes an embedding layer that receives the CAN ID extracted from the normal data and converts it into a vector of a certain size, the converted vector. A Long Short-Term Memory layer (LSTM) that extracts the context of a given sequence based on the context, and a probability distribution for the CAN ID appearing next to the input CAN ID based on the context of the extracted sequence It may include a dense layer (Dense layer).

In an alternative embodiment of the vehicle anomaly detection method, the training of the second neural network model may include inputting the pre-processed normal data and the pseudo-normal data into the second neural network model to convert the pseudo-normal data into an abnormality. It can be learned to classify as data.

* In an alternative embodiment of the vehicle anomaly detection method, the training of the second neural network model includes inputting the pre-processed normal data and additionally acquired attack type hint data into the second neural network model. It can be learned to classify the hint data of the attack type as abnormal data.

In an alternative embodiment of the vehicle anomaly detection method, the training of the second neural network model includes the second neural network based on at least one of the pseudo normal data, the attack type hint data, and the abnormal data. When training the model, the size of the gradient backpropagated can be limited to below a threshold value.

In an alternative embodiment of the vehicle anomaly detection method, the detecting of the vehicle anomaly may include acquiring data generated in the vehicle, pre-processing the acquired data, and pre-learning the pre-processed data and classifying it as normal data or abnormal data by inputting it to the second neural network model, and detecting abnormal signs of the vehicle.

As a computer program stored in a computer readable storage medium according to an embodiment of the present disclosure for realizing the above-described problems, the following operations for detecting abnormal signs of a vehicle when the computer program is executed in one or more processors The operations include: acquiring normal data generated in the vehicle, pre-processing the acquired normal data, and inputting the pre-processed normal data into a pre-trained first neural network model to obtain a pseudo-normal generating data (pseudo normal data), learning a second neural network model based on the generated pseudo normal data, and inputting data generated from the vehicle into the learned second neural network model It may include an operation of detecting abnormal signs of the vehicle.

A computing device for providing a vehicle anomaly detection method according to an embodiment of the present disclosure for realizing the above-described problems, comprising a processor including one or more cores, and a memory, wherein the processor includes the vehicle Acquire normal data generated in A second neural network model may be trained based on the pseudo-normal data, and the data generated from the vehicle may be input to the learned second neural network model to detect an abnormal symptom of the vehicle.

The technical solutions obtainable in the present disclosure are not limited to the above-mentioned solutions, and other solutions not mentioned are clearly to those of ordinary skill in the art to which the present disclosure belongs from the description below. can be understood

According to some embodiments of the present disclosure, it is possible to effectively train a vehicle anomaly detection model in a limited data environment.

Effects obtainable in the present disclosure are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those of ordinary skill in the art to which the present disclosure belongs from the description below. .

Various aspects are now described with reference to the drawings, wherein like reference numbers are used to refer to like elements collectively. In the following example, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of one or more aspects. It will be apparent, however, that such aspect(s) may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to facilitate describing one or more aspects.

1 is a diagram illustrating a block diagram of a computing device that performs an operation for providing a method for detecting anomalies in a vehicle according to an embodiment of the present disclosure.

2 is a diagram illustrating a block configuration diagram of a processor for explaining a method for learning and detecting a vehicle anomaly detection model according to an embodiment of the present disclosure.

3 is a diagram exemplarily illustrating a neural network model of a pseudo-normal data generator, according to an embodiment of the present disclosure.

4 is a diagram illustrating an example of a decision boundary of a supervised learning model according to learning data, according to an embodiment of the present disclosure.

5 is a diagram illustrating a flowchart of a method for detecting anomalies in a vehicle according to an embodiment of the present disclosure.

6 depicts a general schematic diagram of an exemplary computing environment in which embodiments of the present disclosure may be implemented.

Various embodiments and/or aspects are now disclosed with reference to the drawings. In the following description, for purposes of explanation, numerous specific details are set forth to provide a thorough understanding of one or more aspects. However, it will also be appreciated by one of ordinary skill in the art that such aspect(s) may be practiced without these specific details. The following description and accompanying drawings set forth in detail certain illustrative aspects of one or more aspects. These aspects are illustrative, however, and some of various methods may be employed in the principles of the various aspects, and the descriptions set forth are intended to include all such aspects and their equivalents. Specifically, as used herein, “embodiment”, “example”, “aspect”, “exemplary”, etc. are not to be construed as advantageous or advantageous over any aspect or design described herein. It may not be.

Hereinafter, the same or similar components are assigned the same reference numerals regardless of reference numerals, and overlapping descriptions thereof will be omitted. In addition, in describing the embodiments disclosed in the present specification, if it is determined that detailed descriptions of related known technologies may obscure the gist of the embodiments disclosed in the present specification, the detailed description thereof will be omitted. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in the present specification, and the technical ideas disclosed in the present specification are not limited by the accompanying drawings.

Although the first, second, etc. are used to describe various elements or elements, these elements or elements are not limited by these terms, of course. These terms are only used to distinguish one element or component from another. Accordingly, it goes without saying that the first element or component mentioned below may be the second element or component within the spirit of the present invention.

Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used with the meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in a commonly used dictionary are not to be interpreted ideally or excessively unless clearly defined in particular.

In addition, the term “or” is intended to mean an inclusive “or” rather than an exclusive “or.” That is, unless otherwise specified or clear from context, "X employs A or B" is intended to mean one of the natural implicit substitutions. That is, X employs A; X employs B; or when X employs both A and B, "X employs A or B" may apply to either of these cases. It should also be understood that the term “and/or” as used herein refers to and includes all possible combinations of one or more of the listed related items.

Also, the terms "comprises" and/or "comprising" mean that the feature and/or element is present, but excludes the presence or addition of one or more other features, elements, and/or groups thereof. should be understood as not Also, unless otherwise specified or unless it is clear from context to refer to a singular form, the singular in the specification and claims should generally be construed to mean “one or more”.

In addition, as used herein, the terms “information” and “data” can often be used interchangeably.

When a component is referred to as being “connected” or “connected” to another component, it is understood that it may be directly connected or connected to the other component, but other components may exist in between. it should be On the other hand, when it is said that a certain element is "directly connected" or "directly connected" to another element, it should be understood that the other element does not exist in the middle.

The suffixes "module" and "part" for the components used in the following description are given or used in consideration of only the ease of writing the specification, and do not have distinct meanings or roles by themselves.

Objects and effects of the present disclosure, and technical configurations for achieving them will become clear with reference to the embodiments described below in detail in conjunction with the accompanying drawings. In describing the present disclosure, if it is determined that a detailed description of a well-known function or configuration may unnecessarily obscure the subject matter of the present disclosure, the detailed description thereof will be omitted. In addition, the terms described below are terms defined in consideration of functions in the present disclosure, which may vary according to intentions or customs of users and operators.

However, the present disclosure is not limited to the embodiments disclosed below and may be implemented in various different forms. Only the present embodiments are provided so that the present disclosure is complete, and to fully inform those of ordinary skill in the art to which the present disclosure belongs, the scope of the disclosure, and the present disclosure is only defined by the scope of the claims . Therefore, the definition should be made based on the content throughout this specification.

In the present disclosure, a controller area network (CAN) anomaly detection system may include a first model of a long short term memory (LSTM) based pseudo normal data generator and a second model of an anomaly detection unit. Here, the first model of the LSTM-based pseudo-normal data generator may generate pseudo-normal data imitating normal CAN traffic collected from a vehicle in a general situation in which there are no abnormal signs of the vehicle. And, the second model of the abnormality detection unit may detect an abnormality in CAN traffic. Hereinafter, a method in which the computing device according to the present disclosure detects anomalies in CAN traffic using the second model of the anomaly detection unit will be described with reference to FIGS. 1 to 6 .

The configuration of the computing device 100 shown in FIG. 1 is only a simplified example. In an embodiment of the present disclosure, the computing device 100 may include other components for performing the computing environment of the computing device 100 , and only some of the disclosed components may configure the computing device 100 .

The computing device 100 may include a processor 110 , a memory 130 , and a network unit 150 .

In the present disclosure, the processor 110 can detect vehicle anomalies based on self-supervised learning using pseudo-normal data, and can effectively train a vehicle anomaly detection model in a limited data environment.

According to an embodiment of the present disclosure, the processor 110 acquires normal data generated in a vehicle, pre-processes the acquired normal data, and inputs the pre-processed normal data to a pre-trained first neural network model to obtain a doctor Generates pseudo normal data, trains a second neural network model based on the generated pseudo-normal data, and detects abnormal signs of a vehicle by inputting data generated from the vehicle into the learned second neural network model can do.

According to an embodiment of the present disclosure, when acquiring normal data, the processor 110 may acquire controller area network (CAN) traffic data generated in a vehicle in a normal state. The foregoing is merely an example, and the present disclosure is not limited thereto.

According to an embodiment of the present disclosure, the processor 110, when pre-processing the normal data, extracts a CAN ID from CAN messages included in the normal data, and based on the extracted CAN ID CAN ID sequence (sequence) can create As an example, the CAN ID sequence may be expressed as hexadecimal or binary data. The foregoing is merely an example, and the present disclosure is not limited thereto.

According to an embodiment of the present disclosure, when generating pseudo normal data, the processor 110 inputs the pre-processed normal data to the pre-trained first neural network model, and through the pre-trained first neural network model Pseudo-normal data can be generated by predicting the CAN ID that appears next to each CAN ID included in the normal data.

According to an embodiment of the present disclosure, when the processor 110 inputs the pre-processed normal data to the pre-trained first neural network model, the pre-trained normal data including an arbitrary CAN ID or CAN ID sequence It can be input to the first neural network model.

According to an embodiment of the present disclosure, when generating pseudo normal data, the processor 110 generates a next CAN ID according to a probability distribution of a CAN ID appearing next to each CAN ID included in the normal data. You can predict and choose.

According to an embodiment of the present disclosure, when selecting the next CAN ID, the processor 110 may add noise by selecting an arbitrary CAN ID according to a uniform distribution. When adding noise, the processor 110 may select an arbitrary CAN ID with a uniform distribution based on a preset noise ratio.

And, the pseudo-normal data of the present disclosure may include a CAN ID sequence having an arbitrary length. As an example, the pseudo normal data may include a CAN ID sequence having the same length as that of normal data input to the first neural network model. As another example, the pseudo-normal data may include a CAN ID sequence, and some CAN IDs may be selected with a uniform distribution according to a preset noise ratio among all CAN IDs of the CAN ID sequence. The foregoing is merely an example, and the present disclosure is not limited thereto.

Next, when the CAN ID or CAN ID sequence extracted from normal data is input, the first neural network model of the present disclosure is pre-trained to predict the probability distribution for the CAN ID that appears next to the input CAN ID or CAN ID sequence. can Pre-learning of the first neural network model receives the CAN ID extracted from normal data, transforms it into a vector of a certain size, extracts the context of a given sequence based on the transformed vector, and the context of the extracted sequence It is possible to learn by predicting a probability distribution for the CAN ID that appears next to the input CAN ID based on the . As an example, the first neural network model includes an embedding layer that receives a CAN ID extracted from normal data and transforms it into a vector of a certain size, and extracts the context of a given sequence based on the transformed vector. It may include a Long Short-Term Memory layer (LSTM) and a density layer that predicts a probability distribution for a CAN ID appearing next to an input CAN ID based on the context of the extracted sequence. The foregoing is merely an example, and the present disclosure is not limited thereto.

According to an embodiment of the present disclosure, when training the second neural network model, the processor 110 inputs the preprocessed normal data and the pseudo-normal data to the second neural network model to classify the pseudo-normal data as abnormal data. can be taught to do.

According to an embodiment of the present disclosure, when the processor 110 trains the second neural network model, the preprocessed normal data and the additionally acquired hint data of the attack type are input to the second neural network model to enter the attack type. It can be trained to classify the hint data of , as abnormal data.

According to an embodiment of the present disclosure, when the processor 110 trains the second neural network model based on at least one of pseudo normal data, attack type hint data, and abnormal data, You can limit the size below a threshold.

According to an embodiment of the present disclosure, the processor 110 obtains data generated in the vehicle when detecting an abnormal symptom of the vehicle, pre-processes the obtained data, and pre-learned the pre-processed data to the second neural By entering into the network model and classifying it as normal data or abnormal data, abnormal signs of the vehicle can be detected. When acquiring data generated in the vehicle, the processor 110 may acquire controller area network (CAN) traffic data generated in an abnormal or normal vehicle. When the data is pre-processed, the processor 110 may extract a CAN ID from CAN messages included in the data, and generate a CAN ID sequence based on the extracted CAN ID.

As such, the processor 110 may include one or more cores, and a central processing unit (CPU), a general purpose graphics processing unit (GPGPU), and a tensor of the computing device 100 . It may include a processor for deep learning, such as a tensor processing unit (TPU). The processor 110 may read a computer program stored in the memory 130 to detect anomalies of the vehicle according to an embodiment of the present disclosure. According to an embodiment of the present disclosure, the processor 110 may perform an operation for detecting abnormal signs of a vehicle. The processor 110 performs learning of the neural network such as processing of input data for learning in deep learning (DN), extracting features from the input data, calculating an error, and updating the weight of the neural network using backpropagation. calculations can be performed for The processor 110, at least one of a CPU, a GPGPU, and a TPU may process learning of a network function. For example, the CPU and GPGPU can process learning of a network function and detection of anomalies in a vehicle using the network function. In addition, in an embodiment of the present disclosure, learning of a network function and detection of anomalies of an unmanned moving object using the network function may be processed by using the processors of a plurality of computing devices together. In addition, the computer program executed in the computing device according to an embodiment of the present disclosure may be a CPU, GPGPU or TPU executable program.

According to an embodiment of the present disclosure, the memory 130 may store any type of information generated or determined by the processor 110 and any type of information received by the network unit 150 .

According to an embodiment of the present disclosure, the memory 130 includes a flash memory type, a hard disk type, a multimedia card micro type, and a card type memory (eg, SD or XD memory, etc.), Random Access Memory (RAM), Static Random Access Memory (SRAM), Read-Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Programmable Memory (PROM) read-only memory), a magnetic memory, a magnetic disk, and an optical disk may include at least one type of storage medium. The computing device 100 may operate in relation to a web storage that performs a storage function of the memory 130 on the Internet. The description of the above-described memory is only an example, and the present disclosure is not limited thereto.

According to an embodiment of the present disclosure, the network unit 150 may transmit/receive data for detecting abnormal signs of a vehicle to/from other computing devices, servers, and the like. The network unit 150 may transmit/receive data to and from other computing devices, servers, and the like in order to detect anomalies of the vehicle. In addition, the network unit 150 may enable communication between a plurality of computing devices so that learning of a network function is performed in a distributed manner in each of the plurality of computing devices. The network unit 150 may enable communication between a plurality of computing devices to distribute analysis data generation using a network function.

According to an embodiment of the present disclosure, the network unit 150 may be configured regardless of its communication mode, such as wired and wireless, and may include a personal area network (PAN) and a wide area network (WAN). ), etc., may be composed of various communication networks. In addition, the network unit 150 may be a known World Wide Web (WWW), and may use a wireless transmission technology used for short-range communication such as infrared (IrDA) or Bluetooth (Bluetooth). may be The techniques described herein may be used in the networks mentioned above, as well as in other networks.

As such, the present disclosure may generate pseudo-normal data to detect a new type of anomaly that the model has not learned while maintaining the performance advantage of self-supervised learning and utilize it for model training. Accordingly, according to the present disclosure, the generated model can detect not only the learned type of anomaly but also the new type of attack data.

The present disclosure can detect not only the types of anomalies used for model training, but also new types of anomalies. Since the existing self-supervised learning method-based model uses a method of learning the boundary between normal and abnormal data points in the data space, it is dependent on the abnormal data used for training, Although there is a limitation in not being able to determine, in the present disclosure, both the learned type of anomaly as well as the new type of anomaly can be detected by allowing the model to learn the boundary of the spatial region where normal data points are distributed.

As shown in FIG. 2 , the processor of the present disclosure includes a preprocessor 210 , a pseudo-normal data generator 220 including a first model, and an abnormality detector 230 including a second model. can do.

When CAN (Controller Area Network) traffic data generated in a vehicle in a normal state is input, the preprocessor 210 extracts a CAN ID from CAN messages included in the normal data, and a CAN ID sequence based on the extracted CAN ID (sequence) can be created. As an example, the CAN ID sequence may be expressed as hexadecimal or binary data.

That is, the preprocessor 210 may perform a data preprocessing process, and may extract only information necessary for a model from the CAN traffic data. Specifically, the preprocessor 210 may extract CAN ID information from CAN messages included in CAN traffic and convert it into CAN ID sequence data. In this case, the CAN ID sequence data may be expressed as hexadecimal or binary data. However, the present invention is not limited thereto.

This disclosure may use only the CAN ID sequence to model the sequential pattern of CAN traffic excluding the message payload. As an example, in a pre-processing step before model training, CAN IDs may be extracted from the CAN message and divided to form a CAN ID sequence. Here, the CAN ID may be displayed in different forms in the first model of the pseudo-normal data generator 220 and the second model of the abnormality detector 230 . In the case of the pseudo-normal data generator 220 , each CAN ID expressed as a hexadecimal string may be mapped to an integer representation as an index from 0 to the number of CAN IDs of CAN traffic. And. In the case of the anomaly detection unit 230, each CAN ID may be converted into an 11-bit representation. In addition, the CAN ID sequence converted according to each model may be divided into small batches of fixed-length subsequences and supplied to the model. However, the present invention is not limited thereto.

Next, when generating the pseudo-normal data, the pseudo-normal data generator 220 inputs the pre-processed normal data to the pre-trained first neural network model, and adds the pre-trained normal data to the normal data through the pre-trained first neural network model. Pseudo-normal data can be generated by predicting the CAN ID that appears next to each included CAN ID. Here, the normal data input to the pre-trained first neural network model may be an arbitrary CAN ID or normal data including a CAN ID sequence.

When generating the pseudo-normal data, the pseudo-normal data generating unit 220 may predict and select the next CAN ID according to a probability distribution of a CAN ID that appears next to each CAN ID included in the normal data. . Also, when selecting the next CAN ID, the pseudo-normal data generator 220 may select an arbitrary CAN ID according to a uniform distribution to add noise. When adding noise, the pseudo-normal data generator 220 may select an arbitrary CAN ID with a uniform distribution based on a preset noise ratio. The pseudo-normal data may include a CAN ID sequence having any length. For example, the pseudo-normal data may include a CAN ID sequence having the same length as that of normal data input to the first neural network model of the pseudo-normal data generator 220 . As another example, the pseudo-normal data may include a CAN ID sequence, and some CAN IDs may be selected with a uniform distribution according to a preset noise ratio among all CAN IDs of the CAN ID sequence.

The first neural network model of the pseudo-normal data generator 220 predicts a probability distribution for a CAN ID that appears next to the input CAN ID or CAN ID sequence when a CAN ID or CAN ID sequence extracted from normal data is input. can be pre-trained to do so. Pre-learning of the first neural network model receives the CAN ID extracted from normal data, transforms it into a vector of a certain size, extracts the context of a given sequence based on the transformed vector, and the context of the extracted sequence It is possible to learn by predicting a probability distribution for the CAN ID that appears next to the input CAN ID based on the . As an example, the first neural network model includes an embedding layer that receives a CAN ID extracted from normal data and transforms it into a vector of a certain size, and extracts the context of a given sequence based on the transformed vector. It may include a Long Short-Term Memory layer (LSTM) and a density layer that predicts a probability distribution for a CAN ID appearing next to an input CAN ID based on the context of the extracted sequence.

The first neural network model of the pseudo-normal data generator 220 may generate pseudo-normal data based on Long Short Term Memory (LSTM), which is a representative Recurrent Neural Network (RNN) type. Here, the LSTM network may be suitable for processing time series data such as voice and video using a feedback connection. However, the present invention is not limited thereto.

An input to the first neural network model of the pseudo-normal data generator 220 may be a CAN ID or a series of CAN IDs. The first neural network model of the pseudo-normal data generator 220 may be trained to predict which CAN ID is most likely to be the next CAN ID at each time step based on a given CAN ID or series of CAN IDs. . However, the present invention is not limited thereto.

Next, the second neural network model of the abnormality detection unit 230 may be learned based on the pseudonormal data generated by the pseudonormal data generator 220 . In addition, the learned second neural network model may receive data generated from the vehicle and detect an abnormal symptom of the vehicle.

As an example, the second neural network model of the abnormality detection unit 230 may receive preprocessed normal data and pseudonormal data and learn to classify the pseudonormal data as abnormal data.

As another example, the second neural network model of the abnormality detection unit 230 may be trained to classify the attack type hint data as abnormal data by receiving the preprocessed normal data and additionally acquired attack type hint data. .

As another example, the second neural network model of the abnormality detection unit 230 determines the size of the gradient back propagated when learning based on at least one of pseudo normal data, attack type hint data, and abnormal data. It can be limited below a threshold. The reason is that when the model is trained at a high learning rate, an exploding gradient problem may occur. Therefore, if a gradient clipping technique that limits the size of the gradient backpropagated is applied, training can be performed at a high learning rate and the model performance can be further improved.

The second neural network model of the pre-trained abnormality detection unit 230 may detect abnormal signs of the vehicle by classifying it as normal data or abnormal data when data generated in the vehicle is pre-processed and the pre-processed data is input. Here, the data generated in the vehicle may be controller area network (CAN) traffic data generated in the vehicle in an abnormal or normal state. The preprocessed data input to the second neural network model may include a CAN ID sequence generated based on a CAN ID extracted from CAN messages included in the data.

Throughout this specification, computational model, neural network, network function, and neural network may be used interchangeably. A neural network may be composed of a set of interconnected computational units, which may generally be referred to as nodes. These nodes may also be referred to as neurons. A neural network is configured to include at least one or more nodes. Nodes (or neurons) constituting the neural networks may be interconnected by one or more links.

In the neural network, one or more nodes connected through a link may relatively form a relationship between an input node and an output node. The concepts of an input node and an output node are relative, and any node in an output node relationship with respect to one node may be in an input node relationship in a relationship with another node, and vice versa. As described above, an input node-to-output node relationship may be created around a link. One or more output nodes may be connected to one input node through a link, and vice versa.

In the relationship between the input node and the output node connected through one link, the value of the output node may be determined based on data input to the input node. Here, a node interconnecting the input node and the output node may have a parameter. The parameters may be variable, and may be changed by the user or algorithm in order for the neural network to perform a desired function. For example, when one or more input nodes are interconnected to one output node by respective links, the output node sets values input to input nodes connected to the output node and links corresponding to the respective input nodes. An output node value may be determined based on the parameter.

As described above, in a neural network, one or more nodes are interconnected through one or more links to form an input node and an output node relationship in the neural network. The characteristics of the neural network may be determined according to the number of nodes and links in the neural network, correlations between nodes and links, and parameter values assigned to each of the links. For example, when two neural networks having the same number of nodes and links and having different parameter values between the links exist, the two neural networks may be recognized as different from each other.

A neural network may include one or more nodes. Some of the nodes constituting the neural network may configure one layer based on distances from the initial input node. For example, a set of nodes having a distance of n from the initial input node may constitute n layers. The distance from the initial input node may be defined by the minimum number of links that must be passed to reach the corresponding node from the initial input node. However, the definition of such a layer is arbitrary for description, and the order of the layer in the neural network may be defined in a different way from the above. For example, a layer of nodes may be defined by a distance from the final output node.

The initial input node may mean one or more nodes to which data is directly input without going through a link in a relationship with other nodes among nodes in the neural network. Alternatively, in a relationship between nodes based on a link in a neural network, it may mean nodes that do not have other input nodes connected by a link. Similarly, the final output node may refer to one or more nodes that do not have an output node in relation to other nodes among nodes in the neural network. In addition, the hidden node may mean nodes constituting the neural network other than the first input node and the last output node. The neural network according to an embodiment of the present disclosure may be a neural network in which the number of nodes in the input layer may be the same as the number of nodes in the output layer, and the number of nodes decreases and then increases again as progresses from the input layer to the hidden layer. can Also, in the neural network according to another embodiment of the present disclosure, the number of nodes in the input layer may be less than the number of nodes in the output layer, and the number of nodes may be reduced as the number of nodes progresses from the input layer to the hidden layer. there is. In addition, the neural network according to another embodiment of the present disclosure may be a neural network in which the number of nodes in the input layer may be greater than the number of nodes in the output layer, and the number of nodes increases as the number of nodes progresses from the input layer to the hidden layer. can The neural network according to another embodiment of the present disclosure may be a neural network in a combined form of the aforementioned neural networks.

A deep neural network (DNN) may refer to a neural network including a plurality of hidden layers in addition to an input layer and an output layer. Deep neural networks can be used to identify the latent structures of data. In other words, it can identify the potential structure of photos, texts, videos, voices, and music (e.g., what objects are in the photos, what the text and emotions are, what the texts and emotions are, etc.) . Deep neural networks include convolutional neural networks (CNNs), recurrent neural networks (RNNs), auto encoders, generative adversarial networks (GANs), and restricted Boltzmann machines (RBMs). boltzmann machine), a deep belief network (DBN), a Q network, a U network, a Siamese network, and the like. The description of the deep neural network described above is only an example, and the present disclosure is not limited thereto.

Referring to FIG. 3 , in the present disclosure, the first model of the pseudo-normal data generator includes at least one embedding layer 222 , at least one LSTM layer 224 , and at least one dense layer ( 226) may be included. Here, the embedding layer 222 may serve to convert the input CAN ID into a vector of a predetermined size. In addition, the LSTM layer 224 may perform a role of receiving a vector and extracting information. Also, the density layer 226 may finally predict a probability distribution for the next CAN ID. In this case, the first model of the pseudo-normal data generator may be trained to receive CAN ID sequence data extracted from normal CAN traffic and predict a probability distribution for a CAN ID that will appear after the input sequence. However, the present invention is not limited thereto.

Meanwhile, the first model of the pseudo-normal data generating unit for which the training has been completed may generate pseudo-normal data. At this time, the pseudo-normal data is a CAN ID sequence, and each CAN ID constituting the sequence is predicted by the first model of the pseudo-normal data generator at each time step and then probabilistically according to the probability distribution of the CAN ID. can be selected. In addition, the first model of the pseudo-normal data generator that has been trained can add noise by arbitrarily selecting a CAN ID using a uniform distribution rather than a predicted probability distribution when selecting the next CAN ID with a certain probability. there is. However, the present invention is not limited thereto.

Meanwhile, the pseudo-normal data generated from the first model of the pseudo-normal data generating unit may be used together with the normal data for supervised learning of the second model of the abnormal detecting unit. Also, the second model of the abnormality detection unit may be trained to classify the pseudonormal data and the normal data. Accordingly, the computing device of the present disclosure may improve the performance of the model by using the generated pseudo normal data and the abnormal symptom data separately collected as abnormal data together. However, the present invention is not limited thereto.

In the present disclosure, the problem in which the first model of the pseudo-normal data generator predicts the next CAN ID may be regarded as a general multi-class classification problem. As described above, the first model of the LSTM-based pseudo-normal data generator may predict the class of the next CAN ID based on the given previous state of the LSTM layer and the input CAN ID. In this case, in order to output the probability for the CAN ID, a categorical cross entropy loss function may be used.

Specifically, categorical cross entropy can be implemented by adding softmax activation before calculating cross entropy. Softmax activation can be calculated as in Equation 1 below by normalizing the C-dimensional vector s to the C-dimensional vector σ(s) in the range (0, 1) in which the sum is 1.

Here, C may represent the number of CAN IDs. And, the vector s may represent an output logit of the last dense layer. Meanwhile, the cross entropy loss can be calculated as in Equation 2 below.

Here, t _i may indicate the next CAN ID of the given sequence.

Meanwhile, in the present disclosure, when the first model of the pseudo-normal data generator is trained, even if the first model is trained for a small batch of CAN ID sequences, a long CAN ID sequence that mimics the CAN ID sequence of actual CAN traffic is generated. can do. As an example, the computing device of the present disclosure may supply the starting CAN ID to the first model of the pseudo-normal data generating unit by setting the number of CAN IDs to be generated. In this case, the pseudo normal data generating unit may generate the CAN ID sequence. Also, the first model of the pseudo-normal data generator may predict the distribution of the next CAN ID based on the given start CAN ID. In addition, the first model of the pseudo-normal data generator may obtain the index of the next CAN ID by sampling from the predicted probability distribution. In this case, the predicted CAN ID may be used as the next input of the first model. In this case, the first model of the pseudo-stationary data generator, when selecting the next item to increase the diversity of the generated pseudo-stationary data, uses a uniform distribution of a given probability called the noise ratio instead of the probability distribution predicted in the dense layer. You can get a sample constructor model. For example, the first model of the pseudo-normal data generator may be selected by sampling from a uniform distribution of 20% of the CAN IDs of the generated sequence given a uniform sampling probability of 0.2. However, the present invention is not limited thereto.

In the present disclosure, the second model of the anomaly detection unit may be learned through supervised learning using noise pseudo-normal data generated by the first model of the pseudo-normal data generation unit and actual CAN traffic data. Therefore, the training of the second model of the anomaly detection unit may be regarded as a binary classification problem. As an example, samples of actual CAN data and pseudo-normal data may be represented by 0 and 1, respectively. However, the present invention is not limited thereto.

Meanwhile, the second model of the anomaly detection unit may use hint data for an attack, which is a type of attack data, by using additional abnormal data in addition to the pseudo normal data. As an example, the second model of the anomaly detection unit may acquire a specific type of attack data and use it for training together with the noisy pseudo-normal data.

In this case, the hint about the attack may help the second model of the anomaly detection unit to learn the attack pattern and various general data. Here, the hint data may be labeled like noise pseudo-normal data. However, the present invention is not limited thereto.

In the present disclosure, similar to the first model training of the pseudo-normal data generator using categorical cross entropy, the binary cross entropy loss classifies the input CAN ID sequence into two classes, normal and abnormal, so that the second model of the anomaly detection unit is used. can be used to learn. In this case, the binary cross entropy loss may be calculated by Equation 2 above. In this case, C may be set to 2 according to the number of output classes. However, the present invention is not limited thereto.

In the present disclosure, gradient clipping may be applied to prevent a gradient exploding problem that may occur during training of the first model of the pseudo-normal data generator and the second model of the abnormality detector. Specifically, the problem of gradient exploiting is that large error gradients can accumulate, causing too large updates to model weights during training.

Meanwhile, gradient clipping can be implemented by limiting and keeping a gradient small. In particular, the slope

If the norm of is greater than a given threshold value c, the size can be adjusted through Equation 3 below.

where c is the hyperparameter, g is the slope,

may be the standard of g. At this time,

If is less than c, it may not be clipped. In this case, gradient clipping can make the model training process more stable by allowing gradient g to have a norm of max c. However, the present invention is not limited thereto.

As shown in FIG. 4 , the data generated from the vehicle includes normal data and abnormal data (attack data) (a), only normal data (b), and noise pseudo data and normal data. There may be a case (c) included. If the amount of labeled normal data and anomalous data samples is sufficient, the anomaly detection model can be trained to classify normal data and abnormal data. However, there is a problem in that it is difficult to classify only normal data from data including normal data and abnormal data. Accordingly, the present disclosure can improve model performance by generating pseudo-normal data having noise from normal data and learning an anomaly detection model based on the generated noisy pseudo-normal data and normal data.

As shown in FIG. 5 , the computing device of the present disclosure may acquire normal data generated in the vehicle ( S10 ). Here, the computing device may acquire controller area network (CAN) traffic data generated in a vehicle in a normal state.

And, the computing device of the present disclosure may pre-process the acquired normal data (S20). Here, the computing device may extract a CAN ID from CAN messages included in normal data and generate a CAN ID sequence based on the extracted CAN ID.

Next, the computing device of the present disclosure may generate pseudo normal data by inputting the pre-processed normal data to the pre-trained first neural network model ( S30 ). The computing device inputs the pre-processed normal data to the pre-trained first neural network model, predicts the CAN ID that appears next to each CAN ID included in the normal data through the pre-trained first neural network model, data can be generated. When inputting the pre-processed normal data to the pre-trained first neural network model, the computing device may input normal data including an arbitrary CAN ID or CAN ID sequence to the pre-trained first neural network model. When generating the pseudo normal data, the computing device may predict and select the next CAN ID according to a probability distribution of a CAN ID that appears next to each CAN ID included in the normal data. Also, when selecting the next CAN ID, the computing device may add noise by selecting an arbitrary CAN ID according to a uniform distribution. For example, when adding noise, the computing device may select an arbitrary CAN ID with a uniform distribution based on a preset noise ratio. Here, when a CAN ID or a CAN ID sequence extracted from normal data is input, the first neural network model may be pre-trained to predict a probability distribution for a CAN ID that appears next to the input CAN ID or CAN ID sequence. Pre-learning of the first neural network model receives the CAN ID extracted from normal data, transforms it into a vector of a certain size, extracts the context of a given sequence based on the transformed vector, and the context of the extracted sequence It is possible to learn by predicting a probability distribution for the CAN ID that appears next to the input CAN ID based on the .

Next, the computing device of the present disclosure may train the second neural network model based on the generated pseudo-normal data ( S40 ). When training the second neural network model, the computing device may input the pre-processed normal data and the pseudo-normal data into the second neural network model to learn to classify the pseudo-normal data as abnormal data. In addition, when training the second neural network model, the computing device inputs the pre-processed normal data and additionally acquired hint data of the attack type into the second neural network model to classify the hint data of the attack type as abnormal data. can learn In addition, when the computing device trains the second neural network model based on at least one of pseudo normal data, attack type hint data, and abnormal data, the size of the gradient back propagated may be limited to less than or equal to a threshold value. there is.

Next, the computing device of the present disclosure may input data generated from the vehicle into the learned second neural network model to detect an abnormal symptom of the vehicle ( S50 ). The computing device acquires data generated in the vehicle, pre-processes the obtained data, and inputs the pre-processed data to the pre-trained second neural network model when detecting an abnormal symptom of the vehicle to normal data or abnormal data. By classifying, it is possible to detect abnormal signs of the vehicle. When acquiring data generated in the vehicle, the computing device may acquire controller area network (CAN) traffic data generated in the vehicle in an abnormal and normal state. When preprocessing data, the computing device may extract a CAN ID from CAN messages included in the data, and may generate a CAN ID sequence based on the extracted CAN ID.

6 depicts a general schematic diagram of an example computing environment in which embodiments of the present disclosure may be implemented.

Although the present disclosure has been described above generally in the context of computer-executable instructions that may be executed on one or more computers, those skilled in the art will appreciate that the present disclosure may be implemented as a combination of hardware and software and/or in combination with other program modules. you will know

Generally, modules herein include routines, procedures, programs, components, data structures, etc. that perform particular tasks or implement particular abstract data types. In addition, those skilled in the art will appreciate that the methods of the present disclosure can be applied to single-processor or multiprocessor computer systems, minicomputers, mainframe computers as well as personal computers, handheld computing devices, microprocessor-based or programmable consumer electronics, etc. (each of which is It will be appreciated that other computer system configurations may be implemented, including those that may operate in connection with one or more associated devices.

The described embodiments of the present disclosure may also be practiced in distributed computing environments where certain tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

Computers typically include a variety of computer-readable media. Media accessible by a computer includes volatile and nonvolatile media, transitory and non-transitory media, removable and non-removable media. By way of example, and not limitation, computer-readable media may include computer-readable storage media and computer-readable transmission media.

Computer readable storage media includes volatile and nonvolatile media, temporary and non-transitory media, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. includes media. A computer-readable storage medium may be RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital video disk (DVD) or other optical disk storage device, magnetic cassette, magnetic tape, magnetic disk storage device, or other magnetic storage device. device, or any other medium that can be accessed by a computer and used to store the desired information.

A computer readable transmission medium typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and the like. Includes all information delivery media. The term modulated data signal means a signal in which one or more of the characteristics of the signal is set or changed so as to encode information in the signal. By way of example, and not limitation, computer-readable transmission media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared, and other wireless media. Combinations of any of the above are also intended to be included within the scope of computer-readable transmission media.

An example environment 1100 implementing various aspects of the disclosure is shown including a computer 1102 , the computer 1102 including a processing unit 1104 , a system memory 1106 , and a system bus 1108 . do. A system bus 1108 couples system components, including but not limited to system memory 1106 , to the processing device 1104 . The processing device 1104 may be any of a variety of commercially available processors. Dual processor and other multiprocessor architectures may also be used as processing unit 1104 .

The system bus 1108 may be any of several types of bus structures that may further interconnect a memory bus, a peripheral bus, and a local bus using any of a variety of commercial bus architectures. System memory 1106 includes read only memory (ROM) 1110 and random access memory (RAM) 1112 . A basic input/output system (BIOS) is stored in non-volatile memory 1110, such as ROM, EPROM, EEPROM, etc., the BIOS is the basic input/output system (BIOS) that helps transfer information between components within computer 1102, such as during startup. contains routines. RAM 1112 may also include high-speed RAM, such as static RAM, for caching data.

The computer 1102 may also include an internal hard disk drive (HDD) 1114 (eg, EIDE, SATA) - this internal hard disk drive 1114 may also be configured for external use within a suitable chassis (not shown). Yes—a magnetic floppy disk drive (FDD) 1116 (eg, for reading from or writing to removable diskette 1118), and an optical disk drive 1120 (eg, a CD-ROM) for reading from, or writing to, disk 1122, or other high capacity optical media, such as DVD. The hard disk drive 1114 , the magnetic disk drive 1116 , and the optical disk drive 1120 are connected to the system bus 1108 by the hard disk drive interface 1124 , the magnetic disk drive interface 1126 , and the optical drive interface 1128 , respectively. ) can be connected to The interface 1124 for external drive implementation includes, for example, at least one or both of Universal Serial Bus (USB) and IEEE 1394 interface technologies.

These drives and their associated computer-readable media provide non-volatile storage of data, data structures, computer-executable instructions, and the like. In the case of computer 1102, drives and media correspond to storing any data in a suitable digital format. Although the description of computer readable storage media above refers to HDDs, removable magnetic disks, and removable optical media such as CDs or DVDs, those skilled in the art will use zip drives, magnetic cassettes, flash memory cards, cartridges, It will be appreciated that other tangible computer-readable storage media and the like may also be used in the exemplary operating environment and any such media may include computer-executable instructions for performing the methods of the present disclosure. .

A number of program modules may be stored in the drive and RAM 1112 , including an operating system 1130 , one or more application programs 1132 , other program modules 1134 , and program data 1136 . All or portions of the operating system, applications, modules, and/or data may also be cached in RAM 1112 . It will be appreciated that the present disclosure may be implemented in various commercially available operating systems or combinations of operating systems.

A user may enter commands and information into the computer 1102 via one or more wired/wireless input devices, for example, a pointing device such as a keyboard 1138 and a mouse 1140 . Other input devices (not shown) may include a microphone, IR remote control, joystick, game pad, stylus pen, touch screen, and the like. Although these and other input devices are connected to the processing unit 1104 through an input device interface 1142 that is often connected to the system bus 1108, parallel ports, IEEE 1394 serial ports, game ports, USB ports, IR interfaces, and the like may be connected by other interfaces.

A monitor 1144 or other type of display device is also coupled to the system bus 1108 via an interface, such as a video adapter 1146 . In addition to the monitor 1144, the computer typically includes other peripheral output devices (not shown), such as speakers, printers, and the like.

Computer 1102 may operate in a networked environment using logical connections to one or more remote computers, such as remote computer(s) 1148 via wired and/or wireless communications. Remote computer(s) 1148 may be workstations, server computers, routers, personal computers, portable computers, microprocessor-based entertainment devices, peer devices, or other common network nodes, and are generally Although including many or all of the components described, only memory storage device 1150 is shown for simplicity. The logical connections shown include wired/wireless connections to a local area network (LAN) 1152 and/or a larger network, eg, a wide area network (WAN) 1154 . Such LAN and WAN networking environments are common in offices and companies, and facilitate enterprise-wide computer networks, such as intranets, all of which can be connected to a worldwide computer network, for example, the Internet.

When used in a LAN networking environment, the computer 1102 is coupled to the local network 1152 through a wired and/or wireless communication network interface or adapter 1156 . Adapter 1156 may facilitate wired or wireless communication to LAN 1152 , which LAN 1152 also includes a wireless access point installed therein for communicating with wireless adapter 1156 . When used in a WAN networking environment, the computer 1102 may include a modem 1158 , connected to a communication server on the WAN 1154 , or otherwise establishing communications over the WAN 1154 , such as over the Internet. have the means A modem 1158 , which may be internal or external and a wired or wireless device, is coupled to the system bus 1108 via a serial port interface 1142 . In a networked environment, program modules described for computer 1102 , or portions thereof, may be stored in remote memory/storage device 1150 . It will be appreciated that the network connections shown are exemplary and other means of establishing a communication link between the computers may be used.

The computer 1102 may be associated with any wireless device or object that is deployed and operates in wireless communication, for example, a printer, scanner, desktop and/or portable computer, portable data assistant (PDA), communication satellite, wireless detectable tag. It operates to communicate with any device or place and phone. This includes at least Wi-Fi and Bluetooth wireless technologies. Accordingly, the communication may be a predefined structure as in a conventional network or may simply be an ad hoc communication between at least two devices.

Wi-Fi (Wireless Fidelity) makes it possible to connect to the Internet, etc. without a wired connection. Wi-Fi is a wireless technology such as cell phones that allows these devices, eg, computers, to transmit and receive data indoors and outdoors, ie anywhere within range of a base station. Wi-Fi networks use a radio technology called IEEE 802.11 (a, b, g, etc.) to provide secure, reliable, and high-speed wireless connections. Wi-Fi can be used to connect computers to each other, to the Internet, and to wired networks (using IEEE 802.3 or Ethernet). Wi-Fi networks may operate in unlicensed 2.4 and 5 GHz radio bands, for example, at 11 Mbps (802.11a) or 54 Mbps (802.11b) data rates, or in products that include both bands (dual band). there is.

Those of ordinary skill in the art of the present disclosure will recognize that the various illustrative logical blocks, modules, processors, means, circuits, and algorithm steps described in connection with the embodiments disclosed herein include electronic hardware, (convenience For this purpose, it will be understood that it may be implemented by various forms of program or design code (referred to herein as "software") or a combination of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. A person skilled in the art of the present disclosure may implement the described functionality in various ways for each specific application, but such implementation decisions should not be interpreted as a departure from the scope of the present disclosure.

The various embodiments presented herein may be implemented as methods, apparatus, or articles of manufacture using standard programming and/or engineering techniques. The term “article of manufacture” includes a computer program or media accessible from any computer-readable device. For example, computer-readable storage media include magnetic storage devices (eg, hard disks, floppy disks, magnetic strips, etc.), optical disks (eg, CDs, DVDs, etc.), smart cards, and flash drives. memory devices (eg, EEPROMs, cards, sticks, key drives, etc.). The term “machine-readable medium” includes, but is not limited to, wireless channels and various other media that can store, hold, and/or convey instruction(s) and/or data.

The description of the presented embodiments is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the scope of the present disclosure. Thus, the present disclosure is not intended to be limited to the embodiments presented herein, but is to be construed in the widest scope consistent with the principles and novel features presented herein.

Claims

As a vehicle anomaly detection method,

acquiring normal data generated in the vehicle;

pre-processing the acquired normal data;

generating pseudo normal data by inputting the pre-processed normal data into a pre-trained first neural network model;

training a second neural network model based on the generated pseudo-normal data; and

detecting abnormal signs of the vehicle by inputting data generated from the vehicle into the learned second neural network model;

containing,

How to detect vehicle anomalies.
According to claim 1,

The step of acquiring the normal data includes:

Acquiring CAN (Controller Area Network) traffic data generated from a vehicle in a normal state,

How to detect vehicle anomalies.
According to claim 1,

The step of pre-processing the normal data,

extracting a CAN ID from CAN messages included in the normal data; and

generating a CAN ID sequence based on the extracted CAN ID;

containing,

How to detect vehicle anomalies.
According to claim 1,

The generating of the pseudo-normal data comprises:

inputting the pre-processed normal data into the pre-trained first neural network model; and

generating pseudo-normal data by predicting a CAN ID that appears next to each CAN ID included in the normal data through the pre-trained first neural network model;

containing,

How to detect vehicle anomalies.
5. The method of claim 4,

The step of inputting the pre-processed normal data into the pre-trained first neural network model comprises:

Inputting normal data including any CAN ID or CAN ID sequence to the pre-trained first neural network model,

How to detect vehicle anomalies.
5. The method of claim 4,

The generating of the pseudo-normal data comprises:

Predicting and selecting the next CAN ID according to a probability distribution of a CAN ID appearing next to each CAN ID included in the normal data,

How to detect vehicle anomalies.
7. The method of claim 6,

The generating of the pseudo-normal data comprises:

When selecting the next CAN ID, selecting a random CAN ID according to a uniform distribution to add noise,

How to detect vehicle anomalies.
8. The method of claim 7,

When adding the noise, selecting a random CAN ID as the uniform distribution based on a preset noise ratio,

Vehicle anomaly detection method.
According to claim 1,

The first neural network model is

When the CAN ID or CAN ID sequence extracted from the normal data is input, it is pre-learned to predict the probability distribution for the CAN ID that appears next to the input CAN ID or CAN ID sequence,

Vehicle anomaly detection method.
According to claim 1,

The step of training the second neural network model comprises:

learning to classify the pseudo-normal data as abnormal data by inputting the pre-processed normal data and the pseudo-normal data into the second neural network model;

How to detect vehicle anomalies.
According to claim 1,

The step of training the second neural network model comprises:

Learning to classify the hint data of the attack type as abnormal data by inputting the pre-processed normal data and the additionally acquired hint data of the attack type into the second neural network model,

How to detect vehicle anomalies.
According to claim 1,

The step of detecting abnormal signs of the vehicle,

acquiring data generated in the vehicle;

pre-processing the obtained data; and

detecting abnormal signs of the vehicle by inputting the pre-processed data into a pre-trained second neural network model and classifying it as normal data or abnormal data;

containing,

How to detect vehicle anomalies.
13. The method of claim 12,

The step of acquiring data generated in the vehicle includes:

Acquiring CAN (Controller Area Network) traffic data generated from abnormal and normal vehicles,

How to detect vehicle anomalies.
A computer program stored in a computer readable storage medium, wherein, when the computer program is executed on one or more processors, it performs the following operations for detecting abnormal signs of a vehicle, the operations comprising:

acquiring normal data generated in the vehicle;

pre-processing the acquired normal data;

generating pseudo normal data by inputting the pre-processed normal data into a pre-trained first neural network model;

training a second neural network model based on the generated pseudo-normal data; and

detecting abnormal signs of the vehicle by inputting data generated from the vehicle into the learned second neural network model;

containing,

A computer program stored in a computer-readable storage medium.
A computing device for providing a vehicle anomaly detection method, comprising:

a processor including one or more cores; and

Memory;

including,

The processor is

Acquire normal data generated in the vehicle,

pre-processing the obtained normal data,

generating pseudo normal data by inputting the pre-processed normal data into a pre-trained first neural network model;

training a second neural network model based on the generated pseudo-normal data, and

Inputting data generated from the vehicle into the learned second neural network model to detect abnormal symptoms of the vehicle,

computing device.