Method of detecting sequence-based intrusion by using DBC file

1 . A computer-implemented method comprising:

obtaining a first Controller Area Network (CAN) message from a CAN;

determining a first category of the first CAN message among a plurality of categories based on a pre-stored Database CAN (DBC) file mapping message identifiers to functional message categories;

selecting a pre-trained first neural network model corresponding to the first category from among a plurality of pre-trained neural network models;

obtaining first predictive data from the first CAN message using the selected pre-trained first neural network model, the pre-trained first neural network model including a first hidden layer;

comparing the first predictive data with first actual data obtained based on the first CAN message to determine whether the first CAN message is anomalous;

obtaining a second CAN message from the CAN;

determining a second category of the second CAN message among the plurality of categories based on the pre-stored DBC file;

selecting a pre-trained second neural network model corresponding to the second category from among the plurality of pre-trained neural network models;

obtaining second predictive data from the second CAN message using the selected pre-trained second neural network model, the pre-trained second neural network model corresponding to the second category and including a second hidden layer corresponding to the first hidden layer;

comparing the second predictive data with second actual data obtained based on the second CAN message to determine whether the second CAN message is anomalous;

generating a first concatenation value by concatenating a value of a first hidden state obtained from the first hidden layer and a value of a second hidden state obtained from the second hidden layer;

obtaining a first output value from the first concatenation value by using a pre-trained third neural network model; and

comparing the first concatenation value with the first output value to determine whether an entire CAN message including the first CAN message and the second CAN message is anomalous.

2 . The method of claim 1 , wherein the comparing of the first predictive data with the first actual data comprises:

calculating a first loss value of the pre-trained first neural network model based on a difference between the first actual data and the first predictive data; and

comparing the first loss value with a preset first threshold value to determine whether the first CAN message is anomalous.

3 . The method of claim 1 , wherein the pre-trained first neural network model further includes a third hidden layer different from the first hidden layer, and the pre-trained second neural network model further includes a fourth hidden layer corresponding to the third hidden layer, and

wherein the method further comprises:

after comparing the second actual data with the second predictive data obtained based on the second CAN message, generating a second concatenation value obtained by concatenating a value of a third hidden state obtained from the third hidden layer and a value of a fourth hidden state obtained from the fourth hidden layer;

obtaining a second output value from the second concatenation value by using the pre-trained third neural network model; and

comparing the second concatenation value with the second output value to determine whether an entire CAN message including the first CAN message and the second CAN message is anomalous.

4 . The method of claim 1 , wherein the comparing of the first concatenation value with the first output value comprises:

calculating a second loss value of the pre-trained third neural network model based on a difference between the first concatenation value and the first output value; and

comparing the second loss value with a preset second threshold value to determine whether the entire CAN message is anomalous.

5 . The method of claim 1 , wherein the pre-trained first neural network model uses training data generated based on a CAN message corresponding to the first category, and

wherein the pre-trained first neural network model is pre-trained to reduce a difference in values between an output data and the first actual data.

6 . The method of claim 1 , wherein the pre-trained second neural network model uses training data generated based on a CAN message corresponding to the second category, and

wherein the pre-trained second neural network model is pre-trained to reduce a difference in values between an output data and the second actual data.

7 . The method of claim 1 , wherein the pre-trained third neural network model uses, as input data, concatenation data obtained by concatenating values of a plurality of hidden states obtained from the corresponding hidden layers, respectively, of the plurality of neural network models pre-trained for each category of the entire CAN message through different training data, and

wherein the pre-trained third neural network model is pre-trained to output output data corresponding to the input data.

8 . A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform a method comprising:

obtaining a first Controller Area Network (CAN) message from a CAN;

determining a first category of the first CAN message among a plurality of categories based on a pre-stored Database CAN (DBC) file mapping message identifiers to functional message categories;

selecting a pre-trained first neural network model corresponding to the first category from among a plurality of pre-trained neural network models;

obtaining first predictive data from the first CAN message using the selected pre-trained first neural network model, the pre-trained first neural network model including a first hidden layer;

comparing the first predictive data with first actual data obtained based on the first CAN message to determine whether the first CAN message is anomalous;

obtaining a second CAN message from the CAN;

determining a second category of the second CAN message among the plurality of categories based on the pre-stored DBC file;

selecting a pre-trained second neural network model corresponding to the second category from among the plurality of pre-trained neural network models;

obtaining second predictive data from the second CAN message using the selected pre-trained second neural network model, the pre-trained second neural network model corresponding to the second category and including a second hidden layer corresponding to the first hidden layer;

comparing the second predictive data with second actual data obtained based on the second CAN message to determine whether the second CAN message is anomalous;

generating a first concatenation value by concatenating a value of a first hidden state obtained from the first hidden layer and a value of a second hidden state obtained from the second hidden layer;

obtaining a first output value from the first concatenation value by using a pre-trained third neural network model; and

comparing the first concatenation value with the first output value to determine whether an entire CAN message including the first CAN message and the second CAN message is anomalous.

9 . A device comprising at least one processor and a memory coupled to the at least one processor, the memory storing instructions which, when executed by the at least one processor, cause the device to:

obtain a first Controller Area Network (CAN) message from a CAN;

determine a first category of the first CAN message among a plurality of categories, based on a pre-stored Database CAN (DBC) file mapping message identifiers to functional message categories;

select a pre-trained first neural network model corresponding to the first category from among a plurality of pre-trained neural network models,

obtain first predictive data from the first CAN message using a pre-trained first neural network model, the pre-trained first neural network model including a first hidden layer;

compare the first predictive data with first actual data obtained based on the first CAN message to determine whether the first CAN message is anomalous;

obtain a second CAN message from the CAN;

determine a second category of the second CAN message among the plurality of categories based on the pre-stored DBC file;

select a pre-trained second neural network model corresponding to the second category from among the plurality of pre-trained neural network models;

obtain second predictive data from the second CAN message using the selected pre-trained second neural network model, the pre-trained second neural network model corresponding to the second category and including a second hidden layer corresponding to the first hidden layer;

compare the second predictive data with second actual data obtained based on the second CAN message to determine whether the second CAN message is anomalous;

generate a first concatenation value by concatenating a value of a first hidden state obtained from the first hidden layer and a value of a second hidden state obtained from the second hidden layer;

obtain a first output value from the first concatenation value by using a pre-trained third neural network model; and

compare the first concatenation value with the first output value to determine whether an entire CAN message including the first CAN message and the second CAN message is anomalous.