Research On Anomaly Detection Technology For Vehicle Network

China’s car parc has increased year by year,and the proportion of intelligent network of cars has also increased.With the development of 5G,modern vehicles are more closely connected to the Internet,but it also brings many security issues,and the possibility of cars being attacked has increased.For example,an attacker can attack the In-Vehicle Infotainment(IVI)in the car through the Internet,or use the workshop communication to attack the vehicle.Either way,if the attacker wants to control the vehicle,he will eventually attack the vehicle network.These attack behaviors are data anomalies in the vehicle network,so it is very important for the research on vehicle network anomaly detection.Aiming at the existing characteristics of the CAN bus and the existing security problems,this paper conducts anomaly detection research from the perspective of traffic and data content based on the shortcomings of the existing detection algorithms,and realizes the detection of replay attacks and frame forgery in the vehicle network..In summary,the main work and innovations of this article are as follows:(1)According to the shortcomings of the existing vehicle network detection models,a three-layer detection model is proposed,which aims to achieve layered detection of Do S attacks,replay attacks,and frame forgery,and detects the targets and connections of each layer of algorithms Analyzed.(2)Aiming at the shortcoming that the detection algorithm based on information entropy is difficult to detect low-speed injection attacks,this paper studies the detection of low-speed injection attacks.The attack principle of the low-speed injection attack is analyzed,and the LOF(Local Outlier Factor)algorithm is proposed to detect it.The validity of the detection algorithm is verified by experiments;comparative experiments show that the algorithm has higher accuracy than other algorithms.(3)Because the LOF algorithm is difficult to detect frame forgery,this paper proposes to analyze the data of the same ID sequence using a long and short memory network from the perspective of the data domain,and build a corresponding detection model.The detection model is trained using normal data and verified using abnormal data.Experiments show that the algorithm can detect replay attacks and frame forgery,and has a higher accuracy than the existing detection algorithms.Based on the research on packet anomaly detection in vehicle network,this paper proposed the idea of layered detection for different attack behaviors,established a reliable vehicle network anomaly detection model,and made a preliminary exploration of vehicle safety by taking vehicle-mounted network as the entry point.