基于帧间隔-总线电压混合特征的汽车ECU伪装攻击识别  

The Masquerade Intrusion Detection Technique for Automotive ECUs Based on the Hybrid Feature Extraction of Frame Intervals and Bus Voltages

作　　者：刘浩天 魏洪乾 时培成[2] 张幽彤[1] Liu Haotian;Wei Hongqian;Shi Peicheng;Zhang Youtong(School of Mechanical Engineering,Beijing Institute of Technology,Beijing 100081;School of Mechanical Engineering,Anhui Polytechnic University,Wuhu 241000)

机构地区：[1]北京理工大学机械与车辆学院,北京100081 [2]安徽工程大学机械工程学院,芜湖241000

出　　处：《汽车工程》2023年第11期2070-2081,共12页Automotive Engineering

基　　金：国家重点研发计划(2021YFB3101500);国家自然科学基金(52202461);中国博士后基金(2022TQ0032和2022M710380);汽车新技术安徽省工程技术研究中心开放基金(QCKJ202202A)资助。

摘　　要：汽车的网联化和智能化发展提高了汽车内部总线CAN(controller aera network)网络被入侵的风险。不像以太网具有完善的身份认证机制和加密传输协议,总线CAN网络采用明文传输数据,其报文非常容易被非法ECU窃取和攻击。因此,如何设计车载的入侵检测系统识别ECU的非法篡改和伪装攻击成为当前汽车网络安全研究的重点和难点。基于此,本文提出了基于帧间隔-总线电压混合特征提取的汽车ECU伪装攻击识别技术。首先,借助嵌入式设备的时间戳机制获取报文帧的帧间隔时间;同时,采样汽车总线网络的电压信号,并采用快速信号处理技术获取总线电压的特征参数(如电压众数和边沿时间等),以此构建ECU识别的指纹特征(即混合特征参数,包含帧间隔时间、电压众数、位时间、边沿时间等)。然后,利用轻量化的Softmax学习算法训练IDS模型并在线识别潜在的伪装攻击等非法入侵行为。为了验证所提方法的有效性,本文开展了基于ECU设备的硬件试验测试;结果表明,所提方法对所有合法ECU的识别精度高达98.33%,即可以通过甄别报文消息源头判断非法入侵;并且相较于传统的基于单特征指纹的方法,本文所提方法能够提高7%左右的识别精度。The development of networking and intelligence in automobiles has intensified the intrusion risk of automotive CAN(Controller Aera Network).Unlike Ethernet networks with well-established identity authentication mechanisms and encrypted transmission protocols,CAN bus adopts the plaintext means of data,making the messages easily stolen and attacked by illegal ECUs.Therefore,how to design an onboard intrusion detection system(IDS)to identify illegal tampering and disguise attacks has become a key and difficult issue.Accordingly,an automotive ECU camouflage attack recognition technology based on frame interval and bus voltage hybrid feature extraction is proposed in this paper.Firstly,the frame intervals of the message frame are obtained using the timestamp mechanism of the embedded device.Meanwhile,voltage signals of the automotive bus network are sampled,and the characteristic parameters of the bus voltage(such as voltage mode and edge time)are obtained using fast signal processing technology.Thus,the hybrid features including the frame intervals,voltage modes,bit time,edge time are formulated to construct the ECU fingerprints.Then,the lightweight Softmax learning algorithm is used to train the IDS model and identify potential illegal intrusion behaviors such as disguised attacks online.In order to verify the effectiveness of the proposed method,hardware experiments based on ECU devices are conducted in this paper,and the results show that the recognition accuracy of the proposed method for all ECUs is as high as 98.33%,with illegal intrusion identified by the sources of messages.Compared to traditional methods based on single feature fingerprints,the method proposed in this article can improve recognition accuracy by about 7%.

关 键 词：智能网联汽车 总线网络 伪装攻击 混合特征提取 

分 类 号：U495[交通运输工程—交通运输规划与管理]