| The modern technologies such as intelligent transportation,self-driving car,intelligent connected vehicle and 5G have continuous development and application.The car is no longer just a closed mechanical product that can be moved,but an open system with a complex vehicle network.Due to the increasing number of external communication interfaces of automobiles,the information exchange between the internal and external networks of the automobile has become more frequent,which leads to the increasingly prominent security issues of the Internet of Vehicles.As one of the most widely used vehicle buses,the Controller Area Network(CAN)bus is a key subject for hackers.The traditional intrusion detection method has a simple form and is not necessarily applicable to CAN bus networks.Therefore,the research on intrusion detection of in-vehicle CAN bus network has very important practical significance.This article will focus on the most widely used in-vehicle CAN network in the car.Based on the analysis of the CAN bus communication characteristics and network architecture,we have been studied the existing security issue.This paper have summarized the typical attack scenarios of the CAN bus and corresponding intrusion detection methods.The main work and innovation are concluded as follows:(1)On the basis of analyzing the CAN bus communication protocol and using the communication characteristics of the CAN bus network,this paper analyzes and summarizes multiple attack scenarios,including fabrication attack,suspension attack and masquerading attack.Then we introduce common anomaly detection methods:anomaly detection based on statistics,anomaly detection based on knowledge and anomaly detection based on machine learning.(2)Aiming at the existing security problem of in-vehicle CAN network,this paper proposes adding intrusion detection system to protect.According to the characteristics of the CAN bus frame,the data field of each frame message is divided into eight characteristic bits.By studying the CAN bus communication process and combining three classic machine learning anomaly detection algorithms,normal data messages and abnormal data messages will be distinguished.The experiment shows that the all three machine learning algorithms perform well.All the three algorithms have a detection rate of about 95%.Among them,the detection model based on the Adaboost algorithm performs is best.It’s average accuracy rate was up to 96.2%.(3)This paper proposes to add a data dimension reduction module to the existing intrusion detection system.Through the further researching on the characteristics of CAN message data and anomaly detection methods,we found that the message’s multi-dimensional features may reduce the accuracy.Then we add the data dimension reduction module to the original system.After the verification of experiments,the detection rate of the intrusion detection model has been improved,reaching 98.1%. |
