基于DBN与带注意力机制GRU的CAN总线入侵检测模型

Intrusion Detection Model for CAN Bus Using DBN and Attention-Based GRU

为解决车联网中CAN(controller area network)总线易受攻击的问题,提出了一个混合攻击入侵检测模型DGAOIDS。该模型利用无监督的DBN(deep belief nets)学习正常CAN报文数据的基础特征,并利用一个带注意力机制的GRU(gate recurrent unit)网络学习其时序特征,用单分类支持向量机对其进行分类;引入一个对电子控制单元规则学习得到的过滤器,综合过滤器与前述模型的分类结果得出最终的检测结果。实验结果表明,对于不同攻击,基于规则的过滤器的假阳率均为0;DGAO-IDS模型不仅在公开数据集HCRL中的检测结果优于对比模型HyDL-IDS和MD-LSTM,而且该模型在混合攻击数据集MixAt中的精确度达到了91.05%,与HyDL-IDS模型和MD-LSTM模型相比分别高6.55%与7.93%。

To address the vulnerability of the CAN(controller area network)bus in Telematics,this paper proposes a hybrid attack intrusion detection model,DGAO-IDS,which uses an unsupervised DBN to learn the basic features of normal CAN message data and a GRU network with an attention mechanism to learn its temporal features,and finally classifies them using a single classification support vector machine.The final detection result is obtained by combining the filter with the classification results of the aforementioned model.Experimental results demonstrate that the proposed rule-based filters have a false positive rate of zero for different attacks.Moreover,the DGAO-IDS model outperforms the comparative models HyDL-IDS and MDLSTM on the public dataset HCRL.In addition,the model achieves an accuracy of 91.05%on the mixed-attack dataset MixAt,which is 6.55%and 7.93%higher than the HyDL-IDS model and the MD-LSTM model,respectively.