East China Normal University

China Automotive Innovation Co., Ltd

Shanghai Uni-Sentry Intelligent Technology Co., Ltd.

Huibin Huang

Hong Tao Liu

Tao Yu

Wendong Cheng

Heng Hu

Hongxing Hu

The present disclosure provides a method for detecting controller area network (CAN) bus intrusion of a vehicle-mounted network based on a Gaussian mixture model-hidden Markov model (GMM-HMM), including the following steps: obtaining a normal packet of a CAN bus of a vehicle-mounted network, and counting cycles of all packets of each CAN ID based on a time sequence, that is, a time difference between two frames of packets of a same CAN ID, to form a cycle sequence as an input of an algorithm; dividing the cycle sequence of each CAN ID into a fixed length based on the algorithm, and then training a GMM-HMM for each CAN ID to obtain a likelihood probability of a normal cycle sequence; and further counting a cycle sequence of each CAN ID for a tested packet sequence, calculating, after the cycle sequence is input a model, a likelihood probability of generating the sequence, and determining whether the packet sequence is abnormal by comparing the likelihood probability with a threshold of the likelihood probability obtained in the previous step. In the present disclosure, anomaly detection of a packet cycle of a CAN bus is implemented, such that attack behaviors of inserting packets into the bus such as DoS, blur, and replay can be detected.

Method for detecting CAN bus intrusion of vehicle-mounted network based on GMM-HMM and system

Growing community of inventors

Shanghai, China

Huibin Huang