US 11,985,005 B2
Method for detecting CAN bus intrusion of vehicle-mounted network based on GMM-HMM and system
Heng Hu, Shanghai (CN); Hongxing Hu, Shanghai (CN); Wendong Cheng, Shanghai (CN); Huibin Huang, Shanghai (CN); Tao Yu, Shanghai (CN); and Hong Liu, Shanghai (CN)
Assigned to CHINA AUTOMOTIVE INNOVATION CO., LTD, (CN); SHANGHAI UNI-SENTRY INTELLIGENT TECHNOLOGY CO., LTD., (CN); and EAST CHINA NORMAL UNIVERSITY, (CN)
Filed by China Automotive Innovation Co., Ltd, Nanjing (CN); Shanghai Uni-Sentry Intelligent Technology Co., Ltd., Shanghai (CN); and East China Normal University, Shanghai (CN)
Filed on Jul. 22, 2022, as Appl. No. 17/871,200.
Claims priority of application No. 202111287157.3 (CN), filed on Nov. 2, 2021.
Prior Publication US 2023/0137489 A1, May 4, 2023
Int. Cl. H04L 12/40 (2006.01); G06F 18/20 (2023.01)
CPC H04L 12/40 (2013.01) [G06F 18/295 (2023.01); H04L 2012/40215 (2013.01)] 11 Claims
OG exemplary drawing
 
1. A method for detecting controller area network (CAN) bus intrusion of a vehicle-mounted network based on a Gaussian mixture model-hidden Markov model (GMM-HMM), comprising the following:
obtaining a normal packet of a CAN bus of a vehicle-mounted network;
calculating, for each CAN identifier (ID), cycles of all packets of the CAN ID based on a time sequence, to form a cycle sequence as an input of a GMM-HMM algorithm;
constructing and training a GMM-HMM Mid for the cycle sequence of each CAN ID, and calculating a minimum likelihood probability scoreid of a normal sequence of the CAN ID in the model; and
calculating, by using each trained GMM-HMM Mid, a likelihood probability of a cycle sequence that is of a CAN ID corresponding to the model and that is in a tested packet sequence, and determining whether the tested packet sequence is abnormal by comparing the likelihood probability with a scoreid threshold of the corresponding CAN ID.