Research On Anomaly Detection Technology For In-vehicle CAN Bus Message

The scale of China's auto market is huge,and the penetration rate of connected cars continues to increase.With the popularization and application of 5G technology and the development of V2 X technology,vehicles are getting closer and closer to the outside world,increasing the risk of being attacked.The attacker can attack the vehiclemounted network CAN bus through a variety of ways and methods,and finally achieve the purpose of controlling the vehicle.These attacks on the CAN bus are reflected in message abnormalities,so the research on the detection of CAN bus message abnormalities in vehicle network is very important.This paper analyzes the existing CAN bus message abnormal detection methods at home and abroad,and aims at the problems of low performance,consumption of hardware resources and uncontrollable cost of traditional detection methods.Combining the characteristics of the CAN bus protocol,the detection methods for Do S attacks,replay attacks and frame forgery attacks are respectively proposed.Solve the problems of multiple attack detection methods and complex message types,and achieve full coverage of attack behavior detection to the greatest extent.The main work and innovations of this paper include the following three aspects:1.Aiming at the shortcomings of existing anomaly detection models at home and abroad,a hierarchical anomaly detection model is proposed.From the perspectives of CAN bus message flow and data segment content,different detection models are proposed to detect Do S attacks,replay attacks and frame forgery attacks.Analyze the data stream layer by layer to achieve full coverage of attack detection to the greatest extent.2.Aiming at the problem that low-speed frame injection attacks are not easy to be detected,an anomaly detection method based on LOF and DBSCAN is proposed from the perspective of CAN bus message flow.Experiments have verified the effectiveness of this method to detect low-speed frame injection attacks,and the detection effect is better than other existing detection methods.In addition,this method can also detect replay attacks.3.Aiming at the problem that it is difficult to detect frame forgery attacks based on LOF and DBSCAN algorithms,an anomaly detection method based on GRU network is proposed,which detects anomalies from the perspective of CAN bus message data content.The principle of GRU network and the design of anomaly detection model based on GRU network are introduced in detail,and experiments have verified that this method can effectively detect frame forgery attacks and replay attacks.