Research On In-vehicle CAN Bus Intrusion Detection Algorithm

With the booming development of the automotive industry,especially the Internet of Vehicles,the safety of CAN communication in vehicles is facing more and more severe challenges.Improving the safety of CAN communication in vehicle is of great significance to ensure the safety of vehicle network and the safety of the passengers.It can also protect the healthy development of the automobile industry.At present,in-vehicle intrusion detection technology is one of the most used technologies for ensuring the safety of CAN communication in vehicle.It monitors CAN message transmission in the communication network in real time,and alerts the insiders when suspicious messages are found.At present,the research on the intrusion detection algorithm of the CAN bus in vehicle is not mature enough.The detection algorithm has problems such as missed detection,misdetection and difficulty in realizing the algorithm.In order to solve the above problems,based on the characteristics of CAN bus communication and various attack characteristics,this paper proposes an adaptive intrusion detection algorithm based on packet period characteristics and an intrusion detection algorithm based on packet data field features.Secondly,based on the analysis of the characteristics of the actual CAN message period in vehicle,an intrusion detection algorithm based on the characteristics of the message period is proposed for the injection attack and the interrupt attack.Then the algorithm is improved.According to the different periodic variation characteristics of different ID packets,an adaptive intrusion detection algorithm based on packet periodicity is proposed.The effect of adaptive detection threshold on detection accuracy under different periodic characteristics is analyzed.A determination algorithm for the adaptive detection threshold is derived.The algorithm is implemented based on software and hardware.Then,in order to detect forgery and replay attacks,an intrusion detection algorithm based on Hamming distance of data field is proposed.The detection accuracy under various conditions is analyzed in detail and the improvement ideas are given.A new input feature,DACHE feature and new under-sampling method of message data,is designed.And BP neural network is selected as the classification model for training and detection.The classical BP algorithm is optimized by adding momentum terms and adaptive learning rate,and the model is built,trained and tested based on Python.Finally,a new attack method for the in-vehicle CAN network,Bus-off attack,is proposed.We study attack principle,attack process,implementation conditions and implementation methods.Two methods of synchronizing malicious packets and attacked packets during attack implementation are mainly studied.Based on this,we analyze the characteristics of Bus-off attack and propose detection method for this type of attack.Based on STM32,Bus-off attack and detection experiments are implemented.