基于退火优化窗口的CAN总线入侵检测算法  

CAN Bus Intrusion Detection Algorithm Based on Annealing Optimization Window

作　　者：郭金铭 于赫 李宣 GUO Jinming;YU He;LI Xuan(College of Electronic Information Engineering,Changchun University,Changchun 130022,China;College of Computer Science and Technology,Changchun University,Changchun 130022,China)

机构地区：[1]长春大学电子信息工程学院,吉林长春130022 [2]长春大学计算机科学与技术学院,吉林长春130022

出　　处：《佳木斯大学学报(自然科学版)》2024年第12期56-59,51,共5页Journal of Jiamusi University:Natural Science Edition

基　　金：吉林省教育厅科学研究项目(JJKH20230677KJ)。

摘　　要：传统的控制器局域网(CAN)缺乏内置的安全模块,使得攻击者可以轻易获取车内网络广播信息。为消除这种威胁,各种各样的入侵检测方法被提出。机器学习的方法被广泛认为是很有效的,但在车内运用此种方法需要具备强大算力的处理器和较高成本。为了实现车载网络的实时性入侵检测,现利用一种基于滑动窗口的信息熵检测算法,通过较少的计算工作量部署在CAN总线网络节点上,滑动窗口的大小可以通过模拟退火算法进行优化。以DoS攻击为例,此方法可以实时通过信息熵的异常检测到攻击行为的发生。Conventional Controller Area Network(CAN)lacks built-in security modules,which makes it easy for attackers to access in-vehicle network broadcasting information.To eliminate this threat,a variety of intrusion detection methods have been proposed.Machine learning methods are widely recognized as useful,but applying such methods in the vehicle requires processors with powerful computing power and high cost.In order to achieve real-time intrusion detection in in-vehicle networks,a sliding-window based information entropy monitoring algorithm is now utilized,which is deployed on the CAN bus network nodes through less computational effort,and the size of the sliding window can be optimized by a simulated annealing algorithm.Taking the DoS attack as an example,this method can detect the occurrence of the attack behavior in real time by the information entropy anomaly.

关 键 词：控制器局域网 入侵检测 DOS攻击 车载信息安全 

分 类 号：TP393.0[自动化与计算机技术—计算机应用技术]