WO2023160600A1 - 一种车载控制器局域网络入侵检测方法及设备 - Google Patents

一种车载控制器局域网络入侵检测方法及设备 Download PDF

Info

Publication number
WO2023160600A1
WO2023160600A1 PCT/CN2023/077806 CN2023077806W WO2023160600A1 WO 2023160600 A1 WO2023160600 A1 WO 2023160600A1 CN 2023077806 W CN2023077806 W CN 2023077806W WO 2023160600 A1 WO2023160600 A1 WO 2023160600A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
feature
area network
intrusion detection
local area
Prior art date
Application number
PCT/CN2023/077806
Other languages
English (en)
French (fr)
Inventor
戚湧
孙扬威
Original Assignee
南京理工大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 南京理工大学 filed Critical 南京理工大学
Publication of WO2023160600A1 publication Critical patent/WO2023160600A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/23—Clustering techniques
    • G06F18/232—Non-hierarchical techniques
    • G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
    • G06F18/23213—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions with fixed number of clusters, e.g. K-means clustering
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/004—Artificial life, i.e. computing arrangements simulating life
    • G06N3/006—Artificial life, i.e. computing arrangements simulating life based on simulated virtual individual or collective life forms, e.g. social simulations or particle swarm optimisation [PSO]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]

Definitions

  • the invention belongs to the technical field of vehicle networking security, and in particular relates to a vehicle controller local area network intrusion detection method and equipment.
  • the Internet of Vehicles enables reliable communication between vehicles and other Internet of Vehicles entities.
  • the Internet of Vehicles integrates the intra-vehicle network, the inter-vehicle network, and the vehicle-mounted mobile Internet to realize multi-directional network links such as people-vehicle-road-cloud.
  • the in-vehicle network mainly transmits CAN messages and performs operations through the controller area network (CAN).
  • CAN controller area network
  • MTH-IDS multi-layer hybrid intrusion detection system
  • Deep learning is gradually being used in vehicle controller local area network intrusion detection.
  • Deep learning methods usually have high accuracy, but due to the complexity of the model, their computational cost is often high, which is obviously not It is suitable for on-board systems with low computing power.
  • machine learning often has higher efficiency, and machine learning and data mining algorithms have been recognized as effective models for designing intrusion detection systems. Therefore, how to design an efficient and accurate vehicle controller local area network intrusion detection method based on machine learning will become an urgent need.
  • the object of the present invention is: aiming at the deficiencies of the prior art, to provide a method and device for intrusion detection of the local area network of the vehicle controller, which is used to efficiently and accurately detect the intrusion information appearing in the local area network of the vehicle controller, and prevent the intrusion information caused by the vehicle controller Vehicle networking security incidents caused by local area network intrusion.
  • the present invention is realized by adopting the following technical solutions.
  • the present invention provides a method for intrusion detection of a vehicle-mounted controller local area network, characterized in that the method includes:
  • the PSO-LightGBM two-way feature selection method is:
  • the local area network intrusion detection method of the vehicle controller also includes:
  • the clustering mixed sampling method is used for mixed sampling to remove redundancy and generate minority attack samples;
  • the PSO-LightGBM two-way feature selection method is used to characterize the data processed by clustering mixed sampling. Screening, using the training set data of feature screening to train the Stacking integrated model; the clustering mixed sampling method includes:
  • Kmeans to cluster all categories of all training set data, and select data with a set ratio from the cluster center to form a highly representative data subset, which is used for the data subset
  • the set uses the TomekLink method for data cleaning, and the cleaned data is used as a new training set
  • X new represents a newly generated sample
  • X i represents a cluster center sample point
  • X ′ i is the selected K nearest neighbor point
  • ⁇ [0,1] is a random number
  • the sampled majority class samples and the minority class samples generated by SMOTE are spliced to obtain the undetermined data set; the TomekLink sampling method is used to eliminate the noise sample points existing in the undetermined data set, and the training set data after clustering mixed sampling is obtained.
  • the SMOTE method is used to interpolate according to its cluster center to generate additional samples as follows, and generating the cluster center of the minority class is to perform secondary clustering on the basis of the first clustering, according to the secondary clustering
  • the cluster centers use SMOTE to generate the same type of minority class data.
  • the extremely unbalanced means that the sample ratio of the majority class and the minority class is greater than 100: 1.
  • the Stacking integration model is divided into two layers.
  • the first layer uses XGBoost model, LightGBM model and CatBoost model respectively to obtain preliminary classification results through five-fold cross-validation, and uses the preliminary classification results as features for horizontal splicing to obtain a new The training set; the second layer uses the new training set to train the MLP model to obtain the final Stacking integrated model.
  • the present invention also provides a vehicle-mounted controller local area network intrusion detection device, the device includes a memory and a processor; the memory stores a computer program for realizing the above-mentioned vehicle-mounted controller local area network intrusion detection method, and the processor executes said computer program.
  • the present invention provides a computer-readable storage medium, on which a computer program is stored, wherein the computer program is executed by a processor to implement the steps of the above-mentioned vehicle controller local area network intrusion detection method.
  • the vehicle-mounted controller local area network intrusion detection method and equipment of the present invention if the data of each category is extremely unbalanced, cluster the majority of categories, select a plurality of cluster centers, and sample each cluster center, so as to ensure It not only reduces the diversity of most classes of data, but also removes the redundancy of most classes, which can improve the accuracy of model prediction to a certain extent.
  • clustering is performed first to obtain multiple cluster centers of the minority class, and the SMOTE method is used to interpolate according to its cluster centers to generate additional samples, and the generated new samples will not deviate greatly from the original samples.
  • the undetermined data set is obtained by splicing the sampled majority class samples and the minority class samples generated by SMOTE. Use the Tomek Link sampling method to clean out overlapping samples between classes in the undetermined data set, so that the samples that are the nearest neighbors belong to the same class, so that better predictions can be made.
  • the vehicle-mounted controller local area network intrusion detection method and equipment of the present invention perform feature selection on the test set and the training set after clustering mixed sampling, and use the PSO-LightGBM bidirectional feature selection method to screen out the feature combination that makes the overall effect of the model the best , considering the importance of features and the accuracy of the model, it can ensure that the remaining feature subset does not contain useless features and the accuracy of the model is high.
  • the data after clustering mixed sampling and PSO-LightGBM two-way feature selection processing in the vehicle controller local area network intrusion detection method of the present invention has a certain improvement in detection accuracy, and the training used The time is greatly reduced.
  • the vehicle-mounted controller local area network intrusion detection method and device of the present invention greatly reduce data redundancy by performing clustering and mixed sampling on training data, and at the same time over-sample data of a minority category to ensure that the model can accurately identify minority types of attacks, Through the feature selection method, the training speed and accuracy of the model are further improved. Finally, multiple models are fused through the Stacking integration model, which improves the stability and accuracy of the detection. It can be better and better when the computing power is limited. Faster detection of intrusion information appearing in the local area network of the vehicle controller.
  • the method of the present invention has higher detection accuracy and detection accuracy and lower detection false positive rate in the intrusion detection of the vehicle-mounted controller local area network, which shows that the method of the present invention can be more accurate to a certain extent. Good identification of intrusion information has good practical feasibility.
  • Fig. 1 is a flow chart of the intrusion detection method for the vehicle-mounted controller local area network of the present invention.
  • Fig. 2 is a flow chart of the clustering mixed sampling algorithm of the present invention.
  • Fig. 3 is an algorithm flowchart of the PSO-LightGBM bidirectional feature selection of the present invention.
  • Fig. 4 is a flowchart of the Stacking integrated model training method of the present invention.
  • Fig. 5 is a schematic diagram of the training set and the test set of the present invention.
  • Fig. 6 is a schematic diagram of the comparison of training time and detection accuracy using the original data set and the data set processed by clustering mixed sampling and two-way feature selection for training and detection respectively according to the present invention.
  • Fig. 7 is a schematic diagram of the accuracy of each category tested by using the original data set and the data set processed by clustering mixed sampling and two-way feature selection respectively in the present invention.
  • Fig. 8 is a schematic diagram of comparison of detection accuracy between the method of the present invention and existing methods (ANN, KNN, SVM, MTH-IDS).
  • Fig. 9 is a schematic diagram of the comparison between the method of the present invention and the existing methods (ANN, KNN, SVM, MTH-IDS) on the detection false negative rate of each category.
  • Fig. 10 is a schematic diagram comparing the detection accuracy of each category between the method of the present invention and existing methods (ANN, KNN, SVM, MTH-IDS).
  • An embodiment of the present invention is a method for intrusion detection of a vehicle-mounted controller local area network. like As shown in Figure 1, it includes the following steps:
  • the intrusion detection data set of the local area network of the on-board controller of the HCR laboratory is taken as an example, and the collected raw data is numerically processed, and the data with a data field length of 8 is screened.
  • the characteristics of this dataset include timestamp, ID, DLC and Data data.
  • ID is the identifier of the CAN message, a hexadecimal number
  • DLC is the byte number of the data
  • Data data is the CAN message data, 0-8 bytes.
  • the data is normalized to remove the dimension, and the calculation formula is:
  • x′ i represents the normalized data
  • xi is the original data of the feature
  • x min represents the minimum value in the feature data
  • x max represents the maximum value in the feature data
  • the preprocessed data is divided into training set and test set.
  • the preprocessed training set data is mixed and sampled by a clustering mixed sampling method, redundancy is removed, and minority class attack samples are generated at the same time to obtain clustered mixed sampled training set data.
  • the PSO-LightGBM two-way feature selection method is used to perform feature screening on the data processed by clustering and mixed sampling, and the Stacking integrated model is trained using the feature-screened training set data, and the trained Stacking integrated model is obtained for testing the test set data. Make predictions.
  • the clustering mixed sampling method of the present invention includes the following steps.
  • Kmeans clustering sampling is different from random sampling and same-proportion sampling. The purpose of clustering is to minimize the sum of the squares of the distances from each data point to the corresponding cluster center. Therefore, similar data will be divided into the same cluster. Sampling in the class, discarding mostly redundant data, so Kmeans clustering sampling can be done without losing important Reduce the size of the data in the case of information.
  • the majority class and the minority class are processed separately, and finally the sampled majority class sample and the minority class sample generated by SMOTE are spliced to obtain the undetermined data set.
  • the majority class and the minority class are processed separately, and finally the sampled majority class sample and the minority class sample generated by SMOTE are spliced to obtain the undetermined data set.
  • the SMOTE method is used to interpolate according to its cluster center to generate additional samples.
  • X new represents the newly generated sample
  • Xi represents the cluster center sample point
  • X ′ i represents the selected K nearest neighbor points
  • ⁇ [0,1] is a random number.
  • secondary clustering is performed on the basis of the cluster center formed by the first clustering of the minority class, and the cluster center of the secondary cluster is generated using the SMOTE method Minority class data of the same category.
  • the invention uses the TomekLink sampling method to eliminate the noise sample points existing in the undetermined data set, and obtains the training set data after clustering mixed sampling.
  • the basic idea is: when the two closest samples belong to different categories, then these two samples form a TomekLink pair, either one of the samples is noise, or both samples are near the boundary. By removing the TomekLink pair, the overlapping samples between classes can be cleaned, so that the samples that are the nearest neighbors belong to the same class, so that better prediction can be made.
  • the PSO-LightGBM bidirectional feature selection method is used to perform feature screening on the preprocessed data. Including feature selection on the test set during intrusion detection, and feature selection on the training set after clustering and mixed sampling during model training.
  • the present invention uses the PSO-LightGBM two-way feature selection method to screen out the feature combination that makes the overall effect of the model the best.
  • the PSO-LightGBM two-way feature selection method of the present invention first uses the PSO algorithm (Particle Swarm Optimization, particle swarm optimization algorithm) to perform parameter optimization on LightGBM (Light GradientBoosting Machine, gradient boosting machine lightweight framework) , so that the overall effect of the model is optimal; then use LightGBM to sort the feature importance in descending order, filter all the sorted feature sets, delete the least important feature from the current feature set each time, and form a new feature subset , perform feature deletion on the preprocessed data according to the new feature subset, and classify and predict through the Stacking integrated model; if the accuracy of the prediction result does not decrease, delete the feature with the lowest importance, and cycle through this process.
  • the new feature subset is used for feature deletion; if the accuracy of the prediction result decreases, the feature deletion is withdrawn, the feature deletion is completed, and the data set containing only the features after feature deletion is returned.
  • the PSO-LightGBM two-way feature selection method of the present invention comprehensively considers the importance of features and the accuracy of the model, and can ensure that the remaining feature subset does not contain useless features, and the accuracy of the model is high.
  • the trained Stacking ensemble model is used for intrusion detection of vehicle controller local area network.
  • the Stacking integration model of the present invention is mainly divided into two layers.
  • the first layer uses the XGBoost model, LightGBM model and CatBoost model to obtain preliminary classification results through five-fold cross-validation, and uses the preliminary classification results as features for horizontal splicing, saves the splicing results, and obtains a new training set.
  • the second layer uses the data spliced by the first layer (new training set data) to train the MLP model to obtain the final Stacking integrated model.
  • step 4 Use the Stacking integrated model trained in step 3 to perform intrusion detection prediction on the test set data after preprocessing and feature screening, and obtain the final intrusion detection result.
  • the original vehicle controller local area network training set and the vehicle controller local area network training through clustering mixed sampling and PSO-LightGBM bidirectional feature selection are used.
  • Set, train and predict through LightGBM, the training data and test data are shown in Figure 5, and the results are shown in Figure 6 and Figure 7. It can be seen that the data processed by clustering mixed sampling and PSO-LightGBM two-way feature selection has a certain improvement in detection accuracy, and at the same time the training time used is greatly reduced, indicating that the proposed method is effective.
  • the data set of the local area network of the vehicle controller after the same processing is used for verification, and the results are shown in Fig. 8, Fig. 9 and Fig. 10 .
  • the method of the present invention has a better and more stable detection effect on the intrusion detection of the vehicle-mounted controller local area network, which shows to a certain extent that the method of the present invention can better identify intrusion information, and has better practical feasibility.
  • certain aspects of the techniques described above may be implemented by one or more processors of a processing system executing software.
  • the software includes one or more sets of executable instructions stored or otherwise tangibly embodied on a non-transitory computer-readable storage medium.
  • the software may include instructions and certain data that, when executed by the one or more processors, direct the one or more processors to perform one or more aspects of the techniques described above.
  • Non-transitory computer readable storage media may include, for example, magnetic or optical disk storage devices, solid state storage devices such as flash memory, cache memory, random access memory (RAM), or other nonvolatile memory devices.
  • the executable instructions stored on the non-transitory computer readable storage medium may be in source code, assembly language code, object code, or other instruction formats to be interpreted or otherwise executed by one or more processors.
  • a computer-readable storage medium may include any storage medium, or combination of storage media, that can be accessed by a computer system to provide instructions and/or data to the computer system during use.
  • Such storage media may include, but are not limited to, optical media (e.g., compact disc (CD), digital versatile disc (DVD), Blu-ray disc), magnetic media (e.g., floppy disk, magnetic tape, or magnetic hard drive), volatile memory ( For example, random access memory (RAM) or cache), non-volatile memory (eg, read only memory (ROM) or flash memory), or microelectromechanical system (MEMS) based storage media.
  • optical media e.g., compact disc (CD), digital versatile disc (DVD), Blu-ray disc
  • magnetic media e.g., floppy disk, magnetic tape, or magnetic hard drive
  • volatile memory For example, random access memory (RAM) or cache
  • non-volatile memory eg, read only memory (ROM) or flash memory
  • MEMS microelectromechanical system
  • a computer-readable storage medium may be embedded in a computing system (e.g., system RAM or ROM), fixedly attached to a computing system (e.g., a magnetic hard drive), removably attached to a computing system (e.g., an optical disk or a general-purpose serial bus (USB) or coupled to a computer system via a wired or wireless network such as network accessible storage (NAS).
  • a computing system e.g., system RAM or ROM
  • a computing system e.g., a magnetic hard drive
  • removably attached to a computing system e.g., an optical disk or a general-purpose serial bus (USB) or coupled to a computer system via a wired or wireless network such as network accessible storage (NAS).
  • NAS network accessible storage

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • Evolutionary Computation (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Artificial Intelligence (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Evolutionary Biology (AREA)
  • Signal Processing (AREA)
  • Biomedical Technology (AREA)
  • Computer Security & Cryptography (AREA)
  • Health & Medical Sciences (AREA)
  • Probability & Statistics with Applications (AREA)
  • Biophysics (AREA)
  • Computational Linguistics (AREA)
  • General Health & Medical Sciences (AREA)
  • Molecular Biology (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Software Systems (AREA)
  • Traffic Control Systems (AREA)

Abstract

本发明属于车联网安全技术领域，公开了一种车载控制器局域网络入侵检测方法及设备。本发明的方法包括，对采集的原始数据进行数值化和归一化处理，得到预处理后的数据，并划分为训练集和测试集；采用PSO-LightGBM双向特征选择方法对所述预处理后的数据进行特征筛选；使用Stacking集成模型对经过预处理和特征筛选之后的测试集数据进行分类，得到入侵检测结果。本发明用于高效、准确地检测出中车载控制器局域网络出现的入侵信息，防止由于车载控制器局域网络被入侵导致的车联网安全事件。

Description

一种车载控制器局域网络入侵检测方法及设备
本申请要求于2022年02月23日提交中国专利局、申请号为202210165407.4、发明名称为“一种车载控制器局域网络入侵检测方法及设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明属于车联网安全技术领域，具体涉及一种车载控制器局域网络入侵检测方法及设备。
背景技术
随着5G技术、人工智能技术等新兴技术的发展，传统的汽车产业也在逐渐向智能化和网联化的方向转型。车联网作为智能网联汽车主要的通信框架，使车辆与其他车联网实体之间能够进行可靠的通信。车联网将车内网、车际网、车载移动互联网进行融合，实现人-车-路-云等多方位的网络链接。车内网主要通过控制器局域网络(CAN)传送CAN消息和执行操作。然而，随着车联网技术的智能化、网联化进程加快，传统互联网所面临的网络攻击也逐渐出现在车联网环境中。在车内网中，受限于CAN的兼容性，传统的网络安全机制，如某些身份验证机制、安全通信策略和加密技术在车内网环境中并不适用，因此很容易受到网络攻击。2020年整车企业车联网信息服务提供商等相关企业平台遭受的恶意攻击达到280余万次，这些潜在的网络攻击严重危害了智能网联汽车用户的生命安全。传统的网络安全技术，如数据加密、杀毒软件，大多属于被动的防范技术，无法做到及时掌握网络安全状况并进行实时保护，显然不适用于车联网环境。入侵检测作为一种主动安全技术，由于能够在网络受到攻击之前进行拦截，逐渐成为车联网安全研究中的重要内容。
针对车载控制器局域网络入侵检测问题，相关研究人员已经提出了多种方案，其中大多数为基于统计学或机器学习、深度学习模型的入侵检测方法。Song等提出了一种基于CAN消息时间间隔分析的入侵检测方法，该方法可以准确的检测出车载控制器局域网络中的消息注入攻击。Ghaleb等提出了一种基于前馈反向传播人工神经网络(ANN)的车载控制器局域网络入侵检测模型，并在车联网真实入侵数据数据集NGSIM上进行了仿 真实验，实验结果表明，与现有基线模型相比，该模型具有较好的检测效果。Alshammari等通过传统机器学习算法KNN和SVM对车载自组网中的数据进行分析，预测其是否为网络入侵。Yang等提出了一种多层混合入侵检测系统(MTH-IDS)用于车联网的入侵检测，该系统在准确性和低误报率方面有较好的表现。
伴随人工智能技术的发展，深度学习逐渐被用于车载控制器局域网络入侵检测上，深度学习方法通常具有较高的精度，但由于模型的复杂性，它们的计算成本往往很高，很显然不适用于计算能力较低的车载系统上。相比深度学习，机器学习往往具有较高的效率，并且机器学习和数据挖掘算法已经被公认为是设计入侵检测系统的有效模型。因此如何以机器学习为基础，设计一个高效、准确的车载控制器局域网络入侵检测方法将成为迫切需求。
发明内容
本发明目的是：针对现有技术的不足，提供一种车载控制器局域网络入侵检测方法及设备，用于高效、准确地检测出中车载控制器局域网络出现的入侵信息，防止由于车载控制器局域网络被入侵导致的车联网安全事件。
具体地说，本发明是采用以下技术方案实现的。
一方面，本发明提供一种车载控制器局域网络入侵检测方法，其特征在于，所述方法包括：
对采集的原始数据进行数值化和归一化处理，得到预处理后的数据，并划分为训练集和测试集；
采用PSO-LightGBM双向特征选择方法对所述预处理后的数据进行特征筛选；
使用Stacking集成模型对经过预处理和特征筛选之后的测试集数据进行分类，得到入侵检测结果；
所述PSO-LightGBM双向特征选择方法为：
首先使用PSO算法对LightGBM进行参数寻优，使模型整体效果最优；然后使用LightGBM对特征重要性进行降序排列，对排序后的全部特征集合进行筛选，每次从当前的特征集合中删除重要程度最低的特征，构 成新的特征子集，对数据按照新的特征子集进行特征删减，通过所述Stacking集成模型进行分类预测，如果预测结果的精确度未降低，则删除该重要程度最低的特征，循环此过程，对所述新的特征子集进行特征删减；如果预测结果的精确度降低，则撤回此次特征删减，特征删减结束，返回只含特征删减后特征的数据集。
进一步的，所述车载控制器局域网络入侵检测方法，还包括：
对预处理后的训练集数据，通过聚类混合采样方法进行混合采样，去除冗余，同时生成少数类攻击样本；采用PSO-LightGBM双向特征选择方法对经聚类混合采样处理后的数据进行特征筛选，使用特征筛选的训练集数据对Stacking集成模型进行训练；所述聚类混合采样方法包括：
对所述预处理后的训练集数据进行分析，判断各类别是否极度不平衡；
如果样本不存在极度不平衡现象，则使用Kmeans对所有训练集数据所有类别进行聚类，从聚类中心挑选设定比例的数据，形成一个具有高度代表性的数据子集，对所述数据子集使用TomekLink方法进行数据清洗，把清洗之后的数据作为新的训练集；
如果出现各类别数据极度不平衡，对于多数类，从各聚类中心采集设定比例的数据，去除冗余；对于少数类，通过SMOTE方法根据其聚类中心进行插值来生成额外的样本，插值生成方法如下：
Xnew＝Xi+(X’i+Xi)×δ
其中Xnew表示新生成的样本，Xi表示聚类中心样本点，X′ i为选出的K近邻点，δ∈[0,1]是一个随机数；
对采样后的多数类样本和通过SMOTE生成的少数类样本进行拼接，得到待定数据集；使用TomekLink采样法消除待定数据集中存在的噪音样本点，得到聚类混合采样后的训练集数据。
进一步的，所述通过SMOTE方法根据其聚类中心进行插值来生成额外的样本为，生成少数类的聚类中心为在第一次聚类基础上，进行二次聚类，根据二次聚类的聚类中心使用SMOTE生成同一类型的少数类数据。
进一步的，所述极度不平衡指多数类与少数类的样本比例大于100： 1。
进一步的，所述Stacking集成模型分为两层，第一层分别使用XGBoost模型、LightGBM模型以及CatBoost模型通过五折交叉验证得到初步分类结果，将所述初步分类结果作为特征进行横向拼接，得到新的训练集；第二层使用所述新的训练集对MLP模型进行训练，得到最终的Stacking集成模型。
另一方面，本发明还提供车载控制器局域网络入侵检测设备，所述设备包括存储器和处理器；所述存储器存储有实现上述车载控制器局域网络入侵检测方法的计算机程序，所述处理器执行所述计算机程序。
再一方面，本发明提供一种计算机可读存储介质，其上存储有计算机程序，其特征在于：所述的计算机程序被处理器执行时实现上述车载控制器局域网络入侵检测方法的步骤。
本发明的车载控制器局域网络入侵检测方法及设备的有益效果如下：
本发明的车载控制器局域网络入侵检测方法及设备，如果出现各类别数据极度不平衡，则对多数类进行聚类，选取多个聚类中心，对每个聚类中心进行采样，这样既保证了多数类数据的多样性，又能去除多数类的冗余，在一定程度上能提高模型预测的准确性。对于少数类，首先进行聚类，得到少数类的多个聚类中心，通过SMOTE方法根据其聚类中心进行插值来生成额外的样本，生成的新样本不会与原样本产生很大的偏差。对采样后的多数类样本和通过SMOTE生成的少数类样本进行拼接，得到待定数据集。使用Tomek Link采样法清洗掉待定数据集中类间重叠样本，使得互为最近邻的样本均属同一类别，从而能更好的进行预测。
本发明的车载控制器局域网络入侵检测方法及设备，对测试集合以及经过聚类混合采样之后的训练集进行特征选择，使用PSO-LightGBM双向特征选择方法筛选出使模型整体效果最好的特征组合，综合特征的重要程度和模型的准确率进行考虑，可确保留下的特征子集中不含无用特征且模型的准确率较高。通过车载控制器局域网络数据验证，经过本发明的车载控制器局域网络入侵检测方法中聚类混合采样和PSO-LightGBM双向特征选择处理后的数据在检测准确率上有一定的提升，同时所用训练时间大幅降低。
本发明的车载控制器局域网络入侵检测方法及设备通过对训练数据进行聚类混合采样，大幅降低数据的冗余，同时对少数类别的数据进行过采样，确保模型能够准确的识别少数类攻击，通过特征选择方法，进一步提高模型的训练速度和准确率，最后通过Stacking集成模型对多个模型进行融合，提升了检测的稳定性和准确率，可以在计算能力受限的情况下，较好、较快的检测出车载控制器局域网络中出现的入侵信息。本发明方法在车载控制器局域网络入侵检测上与其他现有方法相比，具有更高的检测准确率和检测精确度、更低的检测漏报率，在一定程度上说明本发明方法可以更好的识别入侵信息，具有较好的实际可行性。
说明书附图
图1是本发明的车载控制器局域网络入侵检测方法流程图。
图2是本发明的聚类混合采样的算法流程图。
图3是本发明的PSO-LightGBM双向特征选择的算法流程图。
图4是本发明的Stacking集成模型训练方法流程图。
图5是本发明的训练集和测试集示意图。
图6是本发明的分别采用原始数据集和经过聚类混合采样、双向特征选择处理后的数据集进行训练和检测的训练时间和检测准确率对比示意图。
图7是本发明的分别采用原始数据集和经过聚类混合采样与双向特征选择处理后的数据集进行测试的各类别精确度示意图。
图8是本发明方法与现有方法(ANN、KNN、SVM、MTH-IDS)在检测准确率上的对比示意图。
图9是本发明方法与现有方法(ANN、KNN、SVM、MTH-IDS)在各类别检测漏报率上的对比示意图。
图10是本发明方法与现有方法(ANN、KNN、SVM、MTH-IDS)在各类别检测精确度上的对比示意图。
具体实施方式
下面结合实施例并参照附图对本发明作进一步详细描述。
实施例1：
本发明的一个实施例，为一种车载控制器局域网络入侵检测方法。如 图1所示，包括以下步骤：
一、对采集的原始数据进行数值化和归一化处理，得到预处理后的数据，并划分为训练集和测试集，如图2所示
本实施例以HCR实验室的车载控制器局域网络入侵检测数据集为例，对采集原始数据进行数值化处理，筛选数据字段长度为8的数据。该数据集的特征包括时间戳、ID、DLC以及Data数据。其中，ID为CAN消息的标识符，十六进制数；DLC为数据的字节数；Data数据为CAN消息数据，0-8个字节。为了避免因特征量纲不同对模型造成的影响，对数据进行归一化去除量纲，其计算公式为：
其中，x′i表示经过归一化之后的数据，xi为特征的原始数据，xmin表示该特征数据中的最小值，xmax表示该特征数据中的最大值。
对预处理后的数据划分训练集和测试集。
通过聚类混合采样方法对所述预处理后的训练集数据进行混合采样，去除冗余，同时生成少数类攻击样本，得到经聚类混合采样的训练集数据。采用PSO-LightGBM双向特征选择方法对经聚类混合采样处理后的数据进行特征筛选，使用特征筛选的训练集数据对Stacking集成模型进行训练，得到训练好的Stacking集成模型，用于对测试集数据进行预测。本发明的聚类混合采样方法包括以下步骤。
首先对预处理后的训练集数据进行分析，判断各类别是否极度不平衡。
如果样本不存在极度不平衡现象，则直接使用Kmeans对所有训练集数据所有类别进行聚类，从聚类中心挑选设定比例的数据，形成一个具有高度代表性的数据子集，直接对该数据子集使用TomekLink方法进行数据清洗，把清洗之后的数据作为新的训练集。Kmeans聚类采样与随机采样、同比例采样不同，聚类的目的是最小化每个数据点到相应聚类中心的距离平方和，因此相似的数据会被划分为同一个聚类，从不同聚类中进行采样，丢弃的大多是冗余数据，因此Kmeans聚类采样可以在不损失重要 信息的情况下减少数据规模。
如果样本出现各类别数据极度不平衡，则对多数类和少数类分别进行处理，最后对采样后的多数类样本和通过SMOTE生成的少数类样本进行拼接，得到待定数据集。具体包括：
对于多数类，从各聚类中心采集设定比例的数据，去除冗余。
对于少数类，通过SMOTE方法根据其聚类中心进行插值来生成额外的样本，插值生成方法如下：
Xnew＝Xi+(X’i+Xi)×δ
其中Xnew表示新生成的样本，Xi表示聚类中心样本点，X′ i为选出的K近邻点，δ∈[0,1]是一个随机数。
优选的，在另一个实施例中，对于少数类，在对少数类进行第一次聚类形成的聚类中心基础上进行二次聚类，依据二次聚类的聚类中心使用SMOTE方法生成同种类别的少数类数据。
此时待定数据集并不能直接使用，因为使用SMOTE生成的数据集会含有一些类间重叠样本，此类样本点的存在往往会导致分类困难。本发明使用TomekLink采样法消除待定数据集中存在的噪音样本点，得到聚类混合采样后的训练集数据。其基本思想是：当距离最近的两个样本分属不同类别时，那么这两个样本构成一个TomekLink对，要么其中的一个样本是噪音，要么两个样本均在边界附近。通过移除TomekLink对可以清洗掉类间重叠样本，使得互为最近邻的样本均属同一类别，从而能更好的进行预测。
二、采用PSO-LightGBM双向特征选择方法对所述预处理后的数据进行特征筛选。
本发明的车载控制器局域网络入侵检测方法中，采用PSO-LightGBM双向特征选择方法对所述预处理后的数据进行特征筛选。包括入侵检测时对测试集进行特征选择，以及模型训练时对经过聚类混合采样之后的训练集进行特征选择。
本发明使用PSO-LightGBM双向特征选择方法筛选出使模型整体效果最好的特征组合。
如图3所示，本发明的PSO-LightGBM双向特征选择方法，首先使用PSO算法(Particle Swarm Optimization，粒子群优化算法)对LightGBM(Light GradientBoosting Machine，梯度提升机轻量级框架)进行参数寻优，使模型整体效果最优；然后使用LightGBM对特征重要性进行降序排列，对排序后的全部特征集合进行筛选，每次从当前的特征集合中删除重要程度最低的特征，构成新的特征子集，对预处理后的数据按照新的特征子集进行特征删减，通过Stacking集成模型进行分类预测；如果预测结果的精确度未降低，则删除该重要程度最低的特征，循环此过程，对所述新的特征子集进行特征删减；如果预测结果的精确度降低，则撤回此次特征删减，特征删减结束，返回只含特征删减后特征的数据集。
本发明的PSO-LightGBM双向特征选择方法，综合考虑特征的重要程度和模型的准确率，可确保留下的特征子集中不含无用特征，且模型的准确率较高。
三、使用经过数据预处理和特征选择之后的训练集数据对Stacking集成模型进行训练，保存训练后的Stacking集成模型。训练后的Stacking集成模型用于进行车载控制器局域网络入侵检测。
如图4所示，本发明的Stacking集成模型主要分为两层。第一层分别使用XGBoost模型、LightGBM模型以及CatBoost模型通过五折交叉验证得到初步分类结果，将所述初步分类结果作为特征进行横向拼接，保存拼接结果，得到新的训练集。第二层使用第一层拼接得到的数据(新的训练集数据)对MLP模型进行训练，得到最终的Stacking集成模型。
四、使用步骤三训练好的Stacking集成模型对经过预处理和特征筛选之后的测试集数据进行入侵检测预测，得到最终的入侵检测结果。
为了验证本发明中的聚类混合采样和PSO-LightGBM双向特征选择的有效性，采用原始车载控制器局域网络训练集和经过聚类混合采样与PSO-LightGBM双向特征选择的车载控制器局域网络训练集合，通过LightGBM进行训练并预测，训练数据和测试数据如图5所示，结果如图6、图7所示。可以看出经过聚类混合采样和PSO-LightGBM双向特征选择处理后的数据在检测准确率上有一定的提升，同时所用训练时间大幅降低，表明所提方法有效。
为了验证本发明方法相较于现有方法具有较好的效果和稳定性，使用经过同样处理的车载控制器局域网络数据集进行验证，结果如图8、图9、图10所示。综合上述实验结果分析可知，本发明方法在车载控制器局域网络入侵检测上具有更优、更稳定的检测效果，在一定程度上说明本发明方法可以更好的识别入侵信息，具有较好的实际可行性。
在一些实施例中，上述技术的某些方面可以由执行软件的处理系统的一个或多个处理器来实现。该软件包括存储或以其他方式有形实施在非暂时性计算机可读存储介质上的一个或多个可执行指令集合。软件可以包括指令和某些数据，这些指令和某些数据在由一个或多个处理器执行时操纵一个或多个处理器以执行上述技术的一个或多个方面。非暂时性计算机可读存储介质可以包括例如磁或光盘存储设备，诸如闪存、高速缓存、随机存取存储器(RAM)等的固态存储设备或其他非易失性存储器设备。存储在非临时性计算机可读存储介质上的可执行指令可以是源代码、汇编语言代码、目标代码或被一个或多个处理器解释或以其他方式执行的其他指令格式。
计算机可读存储介质可以包括在使用期间可由计算机系统访问以向计算机系统提供指令和/或数据的任何存储介质或存储介质的组合。这样的存储介质可以包括但不限于光学介质(例如，光盘(CD)、数字多功能光盘(DVD)、蓝光光盘)、磁介质(例如，软盘、磁带或磁性硬盘驱动器)、易失性存储器(例如，随机存取存储器(RAM)或高速缓存)、非易失性存储器(例如，只读存储器(ROM)或闪存)或基于微机电系统(MEMS)的存储介质。计算机可读存储介质可以嵌入计算系统(例如，系统RAM或ROM)中，固定地附接到计算系统(例如，磁性硬盘驱动器)，可移除地附接到计算系统(例如，光盘或通用基于串行总线(USB)的闪存)，或者经由有线或无线网络(例如，网络可访问存储(NAS))耦合到计算机系统。
请注意，并非上述一般性描述中的所有活动或要素都是必需的，特定活动或设备的一部分可能不是必需的，并且除了描述的那些之外可以执行一个或多个进一步的活动或包括的要素。更进一步，活动列出的顺序不必是执行它们的顺序。而且，已经参考具体实施例描述了这些概念。然而，本领域的普通技术人员认识到，在不脱离如下权利要求书中阐述的本公开 的范围的情况下，可以进行各种修改和改变。因此，说明书和附图被认为是说明性的而不是限制性的，并且所有这样的修改被包括在本公开的范围内。
上面已经关于具体实施例描述了益处、其他优点和问题的解决方案。然而，可能导致任何益处、优点或解决方案发生或变得更明显的益处、优点、问题的解决方案以及任何特征都不应被解释为任何或其他方面的关键、必需或任何或所有权利要求的基本特征。此外，上面公开的特定实施例仅仅是说明性的，因为所公开的主题可以以受益于这里的教导的本领域技术人员显而易见的不同但等同的方式进行修改和实施。除了在权利要求书中描述的以外，没有意图限制在此示出的构造或设计的细节。因此明显的是，上面公开的特定实施例可以被改变或修改，并且所有这样的变化被认为在所公开的主题的范围内。

Claims (7)

  1. 一种车载控制器局域网络入侵检测方法，其特征在于，所述方法包括：
    对采集的原始数据进行数值化和归一化处理，得到预处理后的数据，并划分为训练集和测试集；
    采用PSO-LightGBM双向特征选择方法对所述预处理后的数据进行特征筛选；
    使用Stacking集成模型对经过预处理和特征筛选之后的测试集数据进行分类，得到入侵检测结果；
    所述PSO-LightGBM双向特征选择方法为：
    首先使用PSO算法对LightGBM进行参数寻优，使模型整体效果最优；然后使用LightGBM对特征重要性进行降序排列，对排序后的全部特征集合进行筛选，每次从当前的特征集合中删除重要程度最低的特征，构成新的特征子集，对数据按照新的特征子集进行特征删减，通过所述Stacking集成模型进行分类预测；如果预测结果的精确度未降低，则删除该重要程度最低的特征，循环此过程，对所述新的特征子集进行特征删减；如果预测结果的精确度降低，则撤回此次特征删减，特征删减结束，返回只含特征删减后特征的数据集。
  2. 根据权利要求1所述的车载控制器局域网络入侵检测方法，其特征在于，所述方法还包括：
    对预处理后的训练集数据，通过聚类混合采样方法进行混合采样，去除冗余，同时生成少数类攻击样本；采用PSO-LightGBM双向特征选择方法对经聚类混合采样处理后的数据进行特征筛选，使用特征筛选的训练集数据对Stacking集成模型进行训练；所述聚类混合采样方法包括：
    对所述预处理后的训练集数据进行分析，判断各类别是否极度不平衡；
    如果样本不存在极度不平衡现象，则使用Kmeans对所有训练集数据所有类别进行聚类，从聚类中心挑选设定比例的数据，形成一个具有高度代表性的数据子集，对所述数据子集使用TomekLink方法进行数据清洗，把清洗之后的数据作为新的训练集；
    如果出现各类别数据极度不平衡，对于多数类，从各聚类中心采集设 定比例的数据，去除冗余；对于少数类，通过SMOTE方法根据其聚类中心进行插值来生成额外的样本，插值生成方法如下：
    Xnew＝Xi+(X’i+Xi)×δ
    其中Xnew表示新生成的样本，Xi表示聚类中心样本点，X′i为选出的K近邻点，δ∈[0,1]是一个随机数；
    对采样后的多数类样本和通过SMOTE生成的少数类样本进行拼接，得到待定数据集；使用Tomek Link采样法消除待定数据集中存在的噪音样本点，得到聚类混合采样后的训练集数据。
  3. 根据权利要求2所述的车载控制器局域网络入侵检测方法，其特征在于，所述通过SMOTE方法根据其聚类中心进行插值来生成额外的样本为，生成少数类的聚类中心为在第一次聚类基础上，进行二次聚类，根据二次聚类的聚类中心使用SMOTE生成同一类型的少数类数据。
  4. 根据权利要求2所述的车载控制器局域网络入侵检测方法，其特征在于，所述极度不平衡指多数类与少数类的样本比例大于100：1。
  5. 根据权利要求2所述的车载控制器局域网络入侵检测方法，其特征在于，所述Stacking集成模型分为两层，第一层分别使用XGBoost模型、LightGBM模型以及CatBoost模型通过五折交叉验证得到初步分类结果，将所述初步分类结果作为特征进行横向拼接，得到新的训练集；第二层使用所述新的训练集对MLP模型进行训练，得到最终的Stacking集成模型。
  6. 一种车载控制器局域网络入侵检测设备，其特征在于，所述设备包括存储器和处理；所述存储器存储有实现根据权利要求1-5任一所述车载控制器局域网络入侵检测方法的计算机程序，所述处理器执行所述计算机程序。
  7. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于：所述的计算机程序被处理器执行时实现根据权利要求1-5任一所述车载控制器局域网络入侵检测方法的步骤。
PCT/CN2023/077806 2022-02-23 2023-02-23 一种车载控制器局域网络入侵检测方法及设备 WO2023160600A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210165407.4 2022-02-23
CN202210165407.4A CN114222300B (zh) 2022-02-23 2022-02-23 一种车载控制器局域网络入侵检测方法及设备

Publications (1)

Publication Number Publication Date
WO2023160600A1 true WO2023160600A1 (zh) 2023-08-31

Family

ID=80709344

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/077806 WO2023160600A1 (zh) 2022-02-23 2023-02-23 一种车载控制器局域网络入侵检测方法及设备

Country Status (2)

Country Link
CN (1) CN114222300B (zh)
WO (1) WO2023160600A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116915514A (zh) * 2023-09-14 2023-10-20 鹏城实验室 基于双向时间卷积网络的入侵检测方法、装置及智能汽车
CN117081858A (zh) * 2023-10-16 2023-11-17 山东省计算中心（国家超级计算济南中心） 一种基于多决策树入侵行为检测方法、系统、设备及介质
CN117763360A (zh) * 2024-02-22 2024-03-26 杭州光云科技股份有限公司 基于深度神经网络的训练集快速分析方法及电子设备

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114222300B (zh) * 2022-02-23 2022-04-26 南京理工大学 一种车载控制器局域网络入侵检测方法及设备
CN115514581B (zh) * 2022-11-16 2023-04-07 国家工业信息安全发展研究中心 一种用于工业互联网数据安全平台的数据分析方法及设备
CN116032615A (zh) * 2022-12-27 2023-04-28 安徽江淮汽车集团股份有限公司 车载can总线入侵检测方法
CN116647844A (zh) * 2023-04-18 2023-08-25 广州大学 一种基于堆叠集成算法的车载网络入侵检测方法
CN116827607A (zh) * 2023-06-02 2023-09-29 广州大学 一种集成XGBoost和LightGBM模型的车载CAN总线入侵检测算法
CN117040939B (zh) * 2023-10-10 2023-12-15 长春大学 基于改进视觉自注意力模型的车载网络入侵检测方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110138784A (zh) * 2019-05-15 2019-08-16 重庆大学 一种基于特征选择的网络入侵检测系统
US20190379677A1 (en) * 2018-06-12 2019-12-12 International Business Machines Corporation Intrusion detection system
CN111314353A (zh) * 2020-02-19 2020-06-19 重庆邮电大学 一种基于混合采样的网络入侵检测方法及系统
US20210124054A1 (en) * 2019-10-25 2021-04-29 Beijing Baidu Netcom Science And Technology Co., Ltd. Method and apparatus for detecting obstacle
CN114222300A (zh) * 2022-02-23 2022-03-22 南京理工大学 一种车载控制器局域网络入侵检测方法及设备

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9305411B2 (en) * 2012-03-14 2016-04-05 Autoconnect Holdings Llc Automatic device and vehicle pairing via detected emitted signals
US9648446B2 (en) * 2015-09-22 2017-05-09 Veniam, Inc. Systems and methods for shipping management in a network of moving things
CN108288096B (zh) * 2017-01-10 2020-08-21 北京嘀嘀无限科技发展有限公司 用于估算行程时间、模型训练的方法及装置
US20210174257A1 (en) * 2019-12-04 2021-06-10 Cerebri AI Inc. Federated machine-Learning platform leveraging engineered features based on statistical tests
CN113052198A (zh) * 2019-12-28 2021-06-29 中移信息技术有限公司 一种数据处理方法、装置、设备及存储介质
CN112887302A (zh) * 2021-01-22 2021-06-01 中汽创智科技有限公司 汽车控制器局域网络总线入侵检测方法和系统
CN113824684B (zh) * 2021-08-20 2022-11-29 北京工业大学 一种基于迁移学习的车载网络入侵检测方法及系统
CN113923014A (zh) * 2021-10-08 2022-01-11 北京擎天信安科技有限公司 一种基于k近邻法的车载总线网络异常检测方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190379677A1 (en) * 2018-06-12 2019-12-12 International Business Machines Corporation Intrusion detection system
CN110138784A (zh) * 2019-05-15 2019-08-16 重庆大学 一种基于特征选择的网络入侵检测系统
US20210124054A1 (en) * 2019-10-25 2021-04-29 Beijing Baidu Netcom Science And Technology Co., Ltd. Method and apparatus for detecting obstacle
CN111314353A (zh) * 2020-02-19 2020-06-19 重庆邮电大学 一种基于混合采样的网络入侵检测方法及系统
CN114222300A (zh) * 2022-02-23 2022-03-22 南京理工大学 一种车载控制器局域网络入侵检测方法及设备

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116915514A (zh) * 2023-09-14 2023-10-20 鹏城实验室 基于双向时间卷积网络的入侵检测方法、装置及智能汽车
CN116915514B (zh) * 2023-09-14 2023-12-12 鹏城实验室 基于双向时间卷积网络的入侵检测方法、装置及智能汽车
CN117081858A (zh) * 2023-10-16 2023-11-17 山东省计算中心（国家超级计算济南中心） 一种基于多决策树入侵行为检测方法、系统、设备及介质
CN117081858B (zh) * 2023-10-16 2024-01-19 山东省计算中心（国家超级计算济南中心） 一种基于多决策树入侵行为检测方法、系统、设备及介质
CN117763360A (zh) * 2024-02-22 2024-03-26 杭州光云科技股份有限公司 基于深度神经网络的训练集快速分析方法及电子设备

Also Published As

Publication number Publication date
CN114222300A (zh) 2022-03-22
CN114222300B (zh) 2022-04-26

Similar Documents

Publication Publication Date Title
WO2023160600A1 (zh) 一种车载控制器局域网络入侵检测方法及设备
Garg et al. Statistical vertical reduction‐based data abridging technique for big network traffic dataset
Wang et al. An exhaustive research on the application of intrusion detection technology in computer network security in sensor networks
WO2023147786A1 (zh) 基于改进卷积神经网络的车联网入侵检测方法及设备
Zhang et al. Network intrusion detection method based on PCA and Bayes algorithm
WO2016082284A1 (zh) 基于OCSVM双轮廓模型的Modbus TCP通信行为异常检测方法
Zhe et al. DoS attack detection model of smart grid based on machine learning method
CN112528277A (zh) 一种基于循环神经网络的混合入侵检测方法
Dartigue et al. A new data-mining based approach for network intrusion detection
CN111726351B (zh) 基于Bagging改进的GRU并行网络流量异常检测方法
CN112884121A (zh) 基于生成对抗深度卷积网络的流量识别方法
CN113687610B (zh) 一种gan-cnn电力监测系统终端信息防护法方法
CN117240632B (zh) 一种基于知识图谱的攻击检测方法和系统
CN112581027A (zh) 一种风险信息管理方法、装置、电子设备及存储介质
CN115242458B (zh) 一种基于shap的1d-cnn网络流量分类模型的可解释方法
CN112887316B (zh) 一种基于分类的访问控制列表冲突检测系统及方法
CN112860648A (zh) 一种基于日志平台的智能分析方法
CN110689074A (zh) 一种基于模糊集特征熵值计算的特征选择方法
Mohi-Ud-Din et al. NIDS: Random Forest Based Novel Network Intrusion Detection System for Enhanced Cybersecurity in VANET's
KR102604380B1 (ko) 다중 학습 모델을 이용한 5g 엣지 네트워크 침입 탐지 장치 및 이를 이용한 방법
Li et al. A novel machine learning based intrusion detection method for 5G empowered CBTC systems
Kanth Gaussian Naıve Bayes based intrusion detection system
CN106572108A (zh) 一种基于邻域距离的入侵特征选择方法
CN117896121A (zh) 基于工业网络用户行为学习模型的异常检测方法和系统
CN117749499A (zh) 一种网络信息系统场景下的恶意加密流量检测方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23759224

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 18577181

Country of ref document: US