Research On Anomaly Detection Technology For In-vehicle Network

With the application of technology such as the Internet,artificial intelligence,cloud computing and big data,intelligent network of cars is gradually moving into high gear,which has brought various conveniences for people's life.However,its development has also exposed potential safety issues such as vehicles being remotely attacked and maliciously controlled.Even this,there is a phenomenon that vehicles on the network are being manipulated in large quantities,causing a great risk of major social events.Therefore,it has become the focus of current research to explore thinking mode of the information security and a better anomaly detection model which are more suitable for vehicle network.Yet most of the anomaly detection models have a single form of detection,low reliability and imperfect anomaly mechanisms at present.They can not meet the actual needs of intelligent network car safety protection.Consequently it is important that we explored in-depth vehicle network anomaly detection technology for realistic meaning and research worthiness.This paper first comprehensively analyzes the current status of intelligent network car protection at home and abroad,the vehicle network communication mechanism and the information security threats.It summarizes the impact of the general attack mode on the vehicle CAN network.Based on this,we propose a vehicle-mounted network anomaly detection model and design the CAN network traffic anomaly and data anomaly detector in detail.Finally,based on the data anomaly detection,a complete data anomaly judgment mechanism is proposed,which provides a scientific basis for the anomaly judgment of the car network in the intelligent network car.The main research results are as follows:(1)Describe the impact of a unified attack on the CAN network on the basis of the analysis of vehicle network security threats.For a variety of intrusion behavior is difficult to detect,we propose a practical vehicle network anomaly detection model to analyze the traffic effects and data effects caused by different attacks from time domain and data domain respectively.(2)Aiming at the traffic effect caused by aggression,this paper proposes a traffic anomaly detection method based on SVDD by analyzing the traffic characteristics of CAN network.The traffic anomalies are simulated from inserting and deleting data packets respectively.Furthermore,this paper verifies the detection performance of this method at different time windows.On the other hand,aiming at the data effect caused by aggressive behavior,a data anomaly detection method based on HTM network is proposed,which analyzes the data domain of CAN network and simulates both the tampering and replay of the data field.The experiment proves that this method is superior to other existing CAN network anomaly detection methods in data domain(HMM model and RNN model)and have better detection results.(3)Due to the imperfect judgment of the anomalous data sequence of the whole CANnetwork,this paper further proposes an abnormal decision mechanism based on the combination score.In view of the stepwise anomaly grading analysis of data bits,single data packet and entire data packet sequence,we further analyze the best scoring combination for different IDs under different detection models.After that,we separately tested different detection models under the best score combination,when ID detection accuracy,recall rate and F-score are changed.As a result,the anomaly detection performance of the entire vehicle network can be optimized.Intelligent network of car safety is a new field and trend.This paper explores the anomaly detection technology suitable for CAN network in vehicles.There is still a lot of work to be done for its protection.