计算机工程与应用 ›› 2023, Vol. 59 ›› Issue (22): 284-292.DOI: 10.3778/j.issn.1002-8331.2206-0474

• 网络、通信与安全 • 上一篇    下一篇

基于深度学习的轻量级车载网络入侵检测方法

蒋玉长,徐洋,李克资,秦庆凯,张思聪   

  1. 1.贵州师范大学 贵州省信息与计算科学重点实验室,贵阳 550001
    2.贵州省公安厅-贵州师范大学大数据及网络安全发展研究中心,贵阳 550001
  • 出版日期:2023-11-15 发布日期:2023-11-15

Lightweight In-Vehicle Network Intrusion Detection Method Based on Deep Learning

JIANG Yuchang, XU Yang, LI Kezi, QIN Qingkai, ZHANG Sicong   

  1. 1.Key Laboratory of Information and Computing Science of Guizhou Province, Guizhou Normal University, Guiyang 550001, China
    2.Big Data and Network Security Development Research Center of Guizhou Public Security Department & Guizhou Normal University, Guiyang 550001, China
  • Online:2023-11-15 Published:2023-11-15

摘要: 现有基于深度学习的车载网络入侵检测方法存在计算资源消耗和延迟较高的问题。为减少检测延迟并提高检测效果,结合迁移学习构建基于可视化和改进的MobileNet模型的轻量级车载网络入侵检测模型。将攻击流量可视化为彩色图,之后通过双线性插值方法扩大图像以增强数据集并防止模型过拟合。为减少参数和训练过程中的资源消耗,对MoblieNet进行改进,并使用迁移学习对模型进行微调。实验结果表明,该方法在算力有限的树莓派设备上对车载网络流量数据集Car-Hacking和OTIDS的测试准确率、精确率、召回率和F1值达到100%,平均响应时间分别为2.5?ms和2.9?ms,较经典的深度学习模型如ResNet-18等减少了至少40%的响应时间。相比较Confidence Averaging等检测方法,减少了训练资源的消耗,并保证了检测的效果和时间。

关键词: 控制器区域网络, 车载网络, 入侵检测, 轻量级

Abstract: Existing deep learning-based in-vehicle network intrusion detection methods have problems of high computing resource consumption and delay. In order to reduce the detection delay and improve the detection effect, a lightweight in-vehicle network intrusion detection model based on visualization and improved MobileNet model is constructed, combined with transfer learning. The attack traffic is visualized as a color graph, and then the image is enlarged by bilinear interpolation to enhance the dataset and prevent model overfitting. Finally, MoblieNet is improved and the model is fine-tuned by transfer learning in order to reduce parameters and resource consumption during training. Experimental results show that the test accuracy, precision, recall and F1-score of Car-Hacking and OTIDS datasets can reach 100% on raspberry PI devices with limited computing power, and the average response time is 2.5 ms and 2.9 ms, respectively. Compared with classical deep learning models such as ResNet-18, the response time is reduced by at least 40%. Compared with detection methods such as Confidence Averaging, the consumption of training resources is reduced and the detection effect and time are ensured.

Key words: controller area network, in-vehicle network, intrusion detection, lightweight