基于注意力机制的CNN-LSTM网络车内CAN总线入侵检测技术  

A CNN-LSTM Method Based on Attention Mechanism for In-vehicle CAN Bus Intrusion Detection

作　　者：李思涌 吴书汉 孙伟 Li Siyong;Wu Shuhan;Sun Wei(School of Electronics and Information Technology,Sun Yat-sen University,Guangzhou 510275)

机构地区：[1]中山大学电子与信息工程学院,广州510275

出　　处：《信息安全研究》2023年第10期961-967,共7页Journal of Information Security Research

基　　金：国家自然科学基金项目(U2001601)。

摘　　要：随着智能汽车功能的不断扩展和用户群体的增加,汽车自身的网络安全性问题也逐渐引起人们的重视.智能汽车的大量外部接口为攻击者提供了许多种入侵车内网络的机会,而由于车内网络本身没有任何抵御外部攻击的机制,攻击者可以很容易地通过外部接口接入车辆内部网络并操控车辆,引发严重的交通安全事故.目前针对车辆内部网络的入侵检测系统被认为是抵御车辆内部网络入侵的有效方法.提出一种基于带有注意力机制的卷积-长短期记忆神经网络算法进行车内控制器局域网(controller area network,CAN)总线入侵检测.该方法首先将CAN总线通信数据转化为图像,然后利用卷积神经网络提取其中特征,再通过带有注意力机制的长短期记忆神经网络判断CAN总线通信是否异常.实验结果证明提出的方法在各项指标中都有较好的表现,能够有效检测针对CAN总线的入侵.With the continuous expansion of intelligent car functions and the growth of user groups,the network security issues of intelligent cars have gradually arisen people's attention.The numerous external interfaces of intelligent vehicles provide attackers with many opportunities to invade the in-vehicle networks(IVN).However,due to the absence of any mechanism to defend external attacks to the IVN,attackers can easily access the vehicle network and control the vehicle through external interfaces,leading to serious traffic accidents.At present,intrusion detection systems(IDS) targeting at IVN are considered as an effective method to defend network intrusions.This paper will propose a CNN-LSTM method based on attention mechanism to detect CAN bus intrusions.The method first transforms CAN communication data into images,then uses convolutional neural network(CNN) to extract the features,and sends them into long short term memory(LSTM) network with attention mechanism to determine if the communication is anomalous.The experimental results show that the proposed method performs well under all metrics and can detect the CAN intrusions effectively.

关 键 词：控制器局域网总线 车内网络 入侵检测系统 机器学习 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]