Research On Anomaly Detection Technology For In-vehicle CAN Bus Based On Strengthened DCA Immune Algorithm

With the accelerated integration of a new generation of automotive industry and mobile internet technology,traditional vehicles are gradually developing in the direction of intelligence and network connectivity.However,with the frequent occurrence of automotive information security incidents recently,automobiles are facing serious information security threats.Hackers can utilize the in-vehicle remote interface to hack into the car and send malicious messages through the in-vehicle network,thus achieving illegal control of the automobile.The Controller Area Network(CAN)bus,which is the most widely used in in-vehicle network bus at present,is a key target of hackers.Therefore,there is an urgent need to address the security of the invehicle network,especially the CAN bus,for the security protection of automobiles.Currently,encryption and authentication,anomaly detection and security architecture are the most common methods used for the security of CAN bus.However,cryptographic authentication and security architecture solutions require high system resources that make them difficult to apply quickly to resource-constrained CAN bus.In contrast,anomaly detection techniques are low cost,can be easily deployed and is the most viable of the existing security methods.In addition,considering the great similarity between CAN bus and immune systems in terms of internal structure and external intrusion,this thesis proposes an anomaly detection method for in-vehicle CAN bus based on the Strengthened Dendritic Cell Algorithm(Strengthened DCA).The main work of the thesis is as follows.(1)To address the problem that the DCA is not robust in detecting disordered CAN datasets,it is proposed that the most relevant feature subset of CAN data sets be obtained based on particle swarm optimization(PSO)to reduce the impact of disordered data on the algorithm;to address the problem that PSO converges quickly and easily falls into local optimum,it is proposed that the strong global search capability of the gravitational search algorithm(GSA)be introduced to enhance PSO search diversity and improve search accuracy.Then,the two are combined and utlized to optimize the DCA,and an enhanced DCA based on PSOGSA optimization is proposed.Finally,the algorithm is compared with the existing improved DCA to verify the effectiveness of the strengthened DCA.(2)A PSOGSADCA-based anomaly detection model for in-vehicle CAN bus is designed.The architecture mainly consists of a data layer,a feature selection layer,a signal selection layer,a classification layer and an output layer.In this thesis,CAN datasets are collected from real automobiles for performance evaluation.After experimental analysis and comparison with existing in-vehicle CAN bus anomaly detection models,the PSOGSADCA model has a high detection performance with an average accuracy of over 98%.In addition,it can still remain above 95% after several environmental transitions,indicating that the proposed model also has good stability.(3)In response to the problem that existing research rarely classifies CAN message attributes according to the CAN communication matrix,resulting in its inability to detect certain CAN data representing real information,and the problem that the input signals in the signal selection layer of the anomaly detection architecture rely heavily on manual experience,a CAN message attribute matching rule is designed to achieve adaptive signal selection.The CAN communication matrix is first obtained by parsing the CAN database file and analysing the CAN message attributes.Then the matching rule is designed according to the information gain and standard deviation of the attributes,and the most relevant attributes in the CAN subset are extracted and assigned to the input signals of the DCA.