Research On Intrusion Detection Technology Of Vehicle Bus Data

With the deep integration of advanced technologies on automotive electronics,the current automobile industry is rapidly evolving towards the direction of network connection and intelligence,introducing a new scene of vehicle network opening.The attack surface of intelligent networked vehicles is constantly expanding,and the corresponding security requirements are also constantly growing.It is of great significance to study the security of vehicle bus for the development of intelligent networked vehicles.Among the existing security schemes of vehicle bus,anomaly detection technology is the most feasible and practical one.Existing research on CAN bus anomaly detection can be divided into statistical and machine learning methods.These methods have high detection accuracy for single attack type,but it is difficult to effectively protect against multiple attacks simultaneously.Aiming at detecting injection and falsification attacks,existing researches bring high data collection delay and computational complexity of models,which cannot meet the requirement of real-time performance of CAN bus anomaly detection task.In view of the security problems faced by vehicle CAN bus and the shortcomings of existing solutions,this paper studies the anomaly detection of CAN bus based on the graph neural network.The main work is as follows:(1)A graph-level CAN bus anomaly detection model based on graph convolutional network GCN is proposed.In view of anomaly detection in CAN message interval,CAN bus message sequence is converted into graph structure.The model uses the multi-layer graph neural network to learn the node features and relationship information in the graph structure,and generates an embedded representation of the interval graph,and whether there are anomalies in the interval is determined.Experiments on datasets show that the model can detect various types of attacks with 99%accuracy.(2)In order to accurately identify and locate the specific exception messages injected on the bus,and improve the real-time anomaly detection,an Edge-type Node-level Heterograph Intrusion Detection System on CAN,ENHIDS on CAN is proposed.The message sequence is converted into heterogeneous graph,and the neighbor and edge information of nodes in the graph is aggregated by using the heterogeneous graph neural network layer.The importance of different neighbor node and edge types is learned by combining the attention mechanism,which can be used for anomaly judgment.Experiments on different attack datasets show that the model can detect various types of attacks with 98%accuracy,and the training efficiency is better than that of the standard heterogeneous graph neural network model.(3)According to the anomaly detection model proposed in this paper,a CAN bus anomaly detection system based on the graph neural network is designed and implemented.The vehicle bus data transmitted and the anomaly detection information will be provided,so that the user can make a judgment according to the real-time situation.