作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2023, Vol. 49 ›› Issue (1): 138-145. doi: 10.19678/j.issn.1000-3428.0064949

• 网络空间安全 • 上一篇    下一篇

基于聚类混合采样与PSO-Stacking的车载CAN入侵检测方法

孙扬威, 戚湧   

  1. 南京理工大学 计算机科学与工程学院, 南京 210094
  • 收稿日期:2022-06-10 修回日期:2022-07-21 发布日期:2022-09-22
  • 作者简介:孙扬威(1998-),男,硕士研究生,主研方向为车联网安全;戚湧(通信作者),教授、博士。
  • 基金资助:
    国家重点研发计划政府间国际科技创新合作重点专项(2019YFE0123800);欧盟地平线2020科研计划(LC-GV-05-2019);江苏省“333高层次人才培养工程”科研项目(BRA2020044)。

Intrusion Detection Method for In-Vehicle CAN Based on Cluster Mixed Sampling and PSO-Stacking

SUN Yangwei, QI Yong   

  1. School of Computer Science and Engineering, Nanjing University of Science and Technology, Nanjing 210094, China
  • Received:2022-06-10 Revised:2022-07-21 Published:2022-09-22

摘要: 随着信息技术的快速发展以及智能网联汽车的日渐普及,由网络入侵引起的车联网安全事件正在逐年增加。针对车联网中车载控制器局域网络(CAN)存在的网络攻击问题,提出一种改进的车载CAN入侵检测方法。考虑到车载CAN中数据流量较大且各类别数据比例失衡,提出一种聚类混合采样方法来平衡数据,对于流量较大的数据,在聚类后进行欠采样以去除冗余,对于流量较小的数据,使用SMOTE方法合成数据。合并上述两部分数据并使用Tomek Links算法进行数据清洗。使用基于Gini系数的GBDT特征选择方法计算特征重要性,删除重要程度较低的特征以实现数据降维。在此基础上,使用粒子群优化算法对Stacking模型中的基学习器和元分类器进行调优,使用优化后的基学习器和元分类器构建Stacking模型并完成入侵检测。实验结果表明,该方法在主流车载CAN入侵数据集上的检测准确率为98.18%,优于常见的ANN、KNN、SVM、MTHIDS及MGA-DTC模型,且对DoS、Fuzzy等类别样本的检测精确度较高,漏报率较低,体现出较好的先进性和实用性。

关键词: 车联网安全, 聚类混合采样, 粒子群优化算法, Stacking模型, 车载CAN入侵检测, Gini系数

Abstract: With the rapid development of information technology and the increasing popularity of intelligent networked vehicles, Internet of Vehicles(IoV) security incidents caused by network intrusion are increasing yearly.An improved intrusion detection method is proposed to solve the network attack problem of the Controller Area Network(CAN) in the IoV.A significant difference exists between different data types owing to a large amount of data flow in-vehicle CANs.First, a cluster mixed sampling method is developed to balance the data.For a large amount of data, under-sampling is performed after clustering, and redundancy is eliminated.For a small amount of data, the SMOTE method is used to synthesize the data, the above two data are combined, and the Tomek Links algorithm is used for data cleaning.A Gradient Boosting Decision Tree(GBDT) feature selection algorithm based on the Gini coefficient is used to calculate the importance of the features, and the features with low importance were deleted to complete data dimension reduction. Particle Swarm Optimization(PSO) is used to tune the base learner and meta-classifier in the Stacking model.The optimized base learner and meta-classifier are used to build the Stacking model to complete intrusion detection.The experimental results show that the proposed method has a detection accuracy of 98.18% on the popular in-vehicle CAN intrusion dataset, which is better than ANN, KNN, SVM, MTHIDS, and MGA-DTC models.The proposed approach has high accuracy and a low false negative rate for DoS, Fuzzy and other types of samples, with good advancement and practicability.

Key words: Internet of Vehicles(IoV) security, cluster mixed sampling, Particle Swarm Optimization(PSO) algorithm, Stacking model, in-vehicle CAN intrusion detection, Gini coefficient

中图分类号: