Method for detecting can bus intrusion of vehicle-mounted network based on gmm-hmm and system

Abstract

The present disclosure provides a method for detecting controller area network (CAN) bus intrusion of a vehicle-mounted network based on a Gaussian mixture model-hidden Markov model (GMM-HMM), including the following steps: obtaining a normal packet of a CAN bus of a vehicle-mounted network, and counting cycles of all packets of each CAN ID based on a time sequence, that is, a time difference between two frames of packets of a same CAN ID, to form a cycle sequence as an input of an algorithm; dividing the cycle sequence of each CAN ID into a fixed length based on the algorithm, and then training a GMM-HMM for each CAN ID to obtain a likelihood probability of a normal cycle sequence; and further counting a cycle sequence of each CAN ID for a tested packet sequence, calculating, after the cycle sequence is input a model, a likelihood probability of generating the sequence, and determining whether the packet sequence is abnormal by comparing the likelihood probability with a threshold of the likelihood probability obtained in the previous step. In the present disclosure, anomaly detection of a packet cycle of a CAN bus is implemented, such that attack behaviors of inserting packets into the bus such as DoS, blur, and replay can be detected.