Lightweight real-time abnormality detection method using can message analysis and neural network model
A method for detecting an anomaly, which is performed by a computing device including one or more processors according to some embodiments of the present disclosure may include: collecting a CAN message generated in a controller area network (CAN); generating first traffic time interval data and first payload data based on the CAN message; obtaining a first latent vector generated by inputting the first traffic time interval data into a first neural network model; obtaining a second latent vector generated by inputting the first payload data into a second neural network model; generating merged data in which the first latent vector and the second latent vector are merged; and determining whether the CAN message is anomalous by inputting the merged data into a third neural network model.
1 . A method for detecting an anomaly, which is performed by a computing device including one or more processors, the method comprising:
collecting a CAN message generated in a controller area network (CAN);
generating first traffic time interval data and first payload data based on the CAN message;
obtaining a first latent vector generated by inputting the first traffic time interval data into a first neural network model;
obtaining a second latent vector generated by inputting the first payload data into a second neural network model;
generating merged data in which the first latent vector and the second latent vector are merged; and
determining whether the CAN message is anomalous by inputting the merged data into a third neural network model,
wherein the generating of the merged data in which the first latent vector and the second latent vector are merged includes:
generating a first adjusted latent vector in which a first weight is assigned to the first latent vector;
generating a second adjusted latent vector in which a second weight is assigned to the second latent vector; and
generating the merged data in which the first adjusted latent vector and the second adjusted latent vector are merged.
2 . The method of claim 1 , wherein the generating of the first traffic time interval data and the first payload data includes
extracting an Arbitration ID from the CAN message,
extracting a value of a reception time interval of the CAN message from the CAN message, and
generating the first traffic time interval data including the Arbitration ID and the reception time interval value of the CAN message.
3 . The method of claim 1 , wherein the first weight is determined based on a training result of the first neural network model trained based on second traffic time interval data generated based on a normal CAN message.
4 . The method of claim 1 , wherein the second weight is determined based on a training result of the second neural network model trained based on second payload data generated based on the normal CAN message.
5 . The method of claim 1 , further comprising:
wherein at least one of the first neural network model, the second neural network model, or the third neural network model is pre-trained,
performing quantization of converting a floating point arithmetic process performed in at least one of the first neural network model, the second neural network model, or the third neural network model into an integer arithmetic process.
6 . The method of claim 1 , wherein the third neural network model as a model in which Variational Auto-Encoder (VAE) and Generative Adversarial Networks (GAN) are combined is pre-trained so that a posterior distribution of a hidden code vector of the VAE matches a target distribution.
7 . The method of claim 1 , wherein the generating of the first traffic time interval data and the first payload data includes
extracting the Arbitration ID from the CAN message,
extracting a payload from the CAN message,
generating payload analysis data by analyzing the payload, and
generating the first payload data including the Arbitration ID and the payload analysis data.
8 . The method of claim 7 , wherein the generating of the payload analysis data by analyzing the payload includes
checking the amount of change in the payload using at least one of Hamming Distance, Autocorrelation, or Time Series Decomposition,
obtaining payload separation information separated by use or unit by analyzing the amount of change in the payload, and
generating the payload analysis data including the payload separation information.
9 . The method of claim 1 , wherein the third neural network model includes
an encoder unit compressing the input merged data, and generating a third latent vector of which dimension is reduced,
a decoder unit generating first output data in which the third latent vector is converted to a dimension before reduction, and
a discriminator generating second output data based on a target vector extracted from a target distribution, and the third latent vector.
10 . The method of claim 9 , wherein the determining of whether the CAN message is anomalous by inputting the merged data into the third neural network model includes
calculating a loss value of the third neural network model by comparing the merge data and the second output data, and
determining whether the CAN message is anomalous based on the loss value and a predetermined threshold.
11 . A non-transitory computer readable storage medium storing a computer program comprising instructions executed by a processor of a computing device for detecting an anomaly to perform the following steps, the steps comprising:
collecting a CAN message generated in a controller area network (CAN);
generating first traffic time interval data and first payload data based on the CAN message;
obtaining a first latent vector generated by inputting the first traffic time interval data into a first neural network model;
obtaining a second latent vector generated by inputting the first payload data into a second neural network model;
generating merged data in which the first latent vector and the second latent vector are merged; and
determining whether the CAN message is anomalous by inputting the merged data into a third neural network model,
wherein the generating of the merged data in which the first latent vector and the second latent vector are merged includes:
generating a first adjusted latent vector in which a first weight is assigned to the first latent vector;
generating a second adjusted latent vector in which a second weight is assigned to the second latent vector; and
generating the merged data in which the first adjusted latent vector and the second adjusted latent vector are merged.
12 . A computing device for detecting an anomaly, comprising:
a processor including at least one core;
a memory for storing computer programs executable by the processor; and
a network unit,
wherein the processor is configured to
collect a CAN message generated in a controller area network (CAN),
generate first traffic time interval data and first payload data based on the CAN message,
obtain a first latent vector generated by inputting the first traffic time interval data into a first neural network model,
obtain a second latent vector generated by inputting the first payload data into a second neural network model,
generate merged data in which the first latent vector and the second latent vector are merged, and
determine whether the CAN message is anomalous by inputting the merged data into a third neural network model,
wherein the processor is further configured to:
generate a first adjusted latent vector in which a first weight is assigned to the first latent vector;
generate a second adjusted latent vector in which a second weight is assigned to the second latent vector; and
generate the merged data in which the first adjusted latent vector and the second adjusted latent vector are merged.