车辆CAN总线入侵检测 结合GAN生成器 将数据转换为图片

在工业系统中普遍存在样本数据不平衡现象，正常样本数量远远大于异常样本数量。而传统的机器学习算法和深度学习方法，例如朴素贝叶斯和支持向量机，在处理类不平衡问题时，很难获得较高的识别分类准确率，因为它们往往会偏向保证多数类的准确率。为此，本文提出了一种基于生成对抗网络(GAN)的异常检测方法。这个方法中的生成器结构是“编码器–解码器–编码器”的三子网，并且训练该生成器只需要从正常样本中提取特征，所以训练数据集中就不需要异常样本。此系统的异常检测结果由样本的最终得分来判别，其中异常分数由表观损失和潜在损失组成。本文方法的亮点在于可以实现在无异常样本训练的情况下对异常数据样本做检测，通过系统生成更高的异常分数来诊断故障。本项目在凯斯西储大学(CWRU)获得的基准滚动轴承数据集上验证了该方法的可行性和有效性。本文提出的方法在数据集中区分异常样本与正常样本的准确率达到了100%。

生成对抗网络(Generative adversarial Nets，以下简称GANs)因其在图像生成等领域的成功应用而备受关注。然而，其训练的不稳定性一直是一个难以解决的问题，训练过程常常受到模式崩溃、梯度消失和优化不稳定的困扰。一般提高GANs训练稳定性的方法有替代损失函数、梯度惩罚、谱归一化、批量归一化和架构改进等方法。但是这些研究大多缺乏理论基础，未给出相对完善的理论证明，本论文的目标是深入理解基于Wasserstein距离训练GANs的不稳定性，提供较为完整的理论证明。并探讨了进一步改进WGAN训练稳定性的策略，如梯度惩罚(WGAN-GP)，以提高WGAN训练的稳定性和泛化能力。本文的主要研究内容如下：第一部分：分析了WGAN通过最小化Wasserstein距离(简称W距离)代替传统的Jensen-divergence (简称JS散度)，避免了梯度消失问题。其关键优势在于采用了1-Lipschitz连续的判别器，确保了在训练过程中生成器能够从判别器获得有效梯度。其次，证明了W距离相较于其他距离或者散度对于概率分布序列具有良好的连续性和收敛性。第二部分：通过引入W距离替代原来两个分布之间的JS散度，从理论上改善了GANs训练的稳定性。然而，WGAN的实现仍面临挑战，如权重裁剪导致的容量利用不足和梯度消失问题。为此，基于W距离，Gulrajani等人提出了梯度惩罚(WGAN-GP)来满足Lipschitz约束，以进一步提高训练稳定性。但是大多文献直接给出梯度惩罚常数为1，并未给出具体证明，在本文中给出了证明。

智能汽车的复杂性以及其多源异构数据(如CAN总线、声音、图像等)的特性，对传统的故障诊断方法提出了严峻挑战，导致其在处理海量信息时效率和准确性均难以满足要求。针对此问题，本文提出一种结合多模态数据融合与深度强化学习的智能故障诊断新方法。该方法首先通过设计高效的深度学习特征提取与融合机制，将智能汽车中采集的CAN总线数据、声音和图像等异构多模态信息进行深度融合，形成一个统一的高维状态表示。其次，我们将智能故障诊断过程建模为一个马尔可夫决策过程(MDP)。在此框架下，我们引入一个深度强化学习(DRL)代理，使其通过与模拟环境的交互，学习并优化诊断策略。该代理能够基于全面的多模态融合状态信息，做出序列化诊断决策，以最大化累积奖励，从而有效提高诊断的准确性与效率。我们在一个基于Kaggle公开数据集构建的模拟仿真环境中对所提方法进行了验证。实验结果表明，与单一模态及传统诊断方法相比，本文方法在显著提升诊断准确率的同时，其基于深度强化学习的序贯决策能力有效减少了平均诊断步骤数，证明了该方法在提高智能汽车故障诊断的准确性与效率方面的优越性。

Ensuring the cybersecurity of modern vehicles is paramount as connected and autonomous systems become increasingly prevalent. However, existing intrusion detection systems (IDS) often face challenges such as imbalanced datasets and high computational demands, limiting their practical deployment in automotive environments. To address these limitations, we employ spectral normalization GAN to synthesize anomalous data, achieving a balanced distribution across four attack categories and normal traffic. We further propose a lightweight classification model, named Depthwise Separable Convolutional Kolmogorov–Arnold network (DSC-KAN), which incorporates Kolmogorov–Arnold (K–A) theorem to enhance efficiency while maintaining high classification performance. Experimental results demonstrate that our approach outperforms existing methods in accuracy and computational efficiency, offering a robust and practical IDS solution. The proposed method has the potential to significantly improve vehicle network security, ensuring safer and more reliable deployment of connected and autonomous driving technologies.

As the de-facto standard for in-vehicle networks, the Controller Area Network (CAN) is exposed to different types of cyber-attacks due to the lack of security mechanisms. Intrusion Detection Systems (IDS) can be deployed to identify the attacks by monitoring host and network activities. However, there is little abnormal historical data that can be used to train deep learning models, resulting in data imbalance and biased trained model. Hence, we propose a prediction-based IDS framework for detecting the attacks on a CAN bus, which consists of two deep-learning models of the data augmentation module and the prediction module. Firstly, the Generative Adversarial Networks (GAN) was utilized as the data augmentation module to automatically generate high-quality attack data and balance the training set. Two networks were introduced as the prediction module, and the first one is a convolutional neural networks (CNN) that predicts correlated data of all CAN IDs, and the second one is an LSTM that predicts messages individually using times series data for each CAN ID. Furthermore, an intrusion detection equipment for the CAN bus was designed and the real vehicle test was conducted. The experimental results show that the proposed method can detect CAN attacks, with an average F1-score of 99.74% and an accuracy of 99.78%. Compared with the reference work, the F1-score of attack detection is improved by 15.25%, and also the detection time is reduced by 29.11%.

The growing abundance of electronic control units and peripheral devices loaded and connected to smart connected cars has resulted in a constant stream of cyber-attacks at various levels and dimensions. The CAN-FD bus plays a crucial role in smart connected cars. Currently, the majority of research efforts remain centered around the traditional CAN bus, with fewer studies addressing intrusion detection for the CAN-FD bus in smart connected vehicles. CAN-FD boasts a notable improvement in transmission speed, capable of reaching up to 8 Mbps compared to the 1 Mbps of the standard CAN bus. Utilizing intrusion detection systems designed for the CAN bus in high-speed CAN-FD applications could potentially hinder normal transmission and detection efficiency. Hence, we focus on the attack and intrusion detection of CAN-FD bus ID nodes to prevent unauthorized access and potential malicious attacks. We propose an ID intrusion detection system based on an improved Generative Adversarial Network (GAN) model, which consists of two parts: a data pre-processing module and a detection module. To apply the GAN model to the vehicle bus, we perform pre-processing of the bus data. We introduce the concept of dual discriminator to improve the detection rate and enable the handling of unknown attacks. With the output of dual discriminator, we can determine whether there are any anomalies in the detection data. First, we use a data pre-processing module to convert the ID segments of the automobile CAN-FD into binary image encoding to form ID images. Subsequently, these ID images are fed into an ID image feature extractor in the detection module to extract various auxiliary features. The discriminator receives these auxiliary features and calculates the probability of whether the received image is a normal ID image or not to determine the authenticity of the ID image. The experimental results show that the proposed intrusion detection system is able to detect a message within 0.15 ms, which fully meets the real-time detection requirements while the vehicle is in motion. The average detection rate of the proposed system for different types of attacks is 99.93%, which is an average of 1.2% improvement of the detection rate over the GIDS algorithm. The proposed system not only ensures the normal communication of CAN-FD bus but also realizes real-time and accurate intrusion detection.

The intelligent connected vehicle (ICV) has garnered considerable attention in recent years due to developments in vehicle-to-everything (V2X) technology, 5G communication networks, and more. However, the connection between the in-vehicle network (IVN) and external network exposes vehicles to potential intrusion risks. In particular, the controller area network (CAN) protocol, a typical IVN responsible for electronic control unit cooperation, lacks defense mechanisms like encryption or authentication, further making vehicles vulnerable to intrusion. Therefore, many scholars propose countermeasures to address the weakness of CAN, namely message authentication and intrusion detection systems (IDS). Given that the former may occupy extra bandwidth and computational resources, we prioritize IDS in this paper. Thus, we propose a generative adversarial network assisted contextual pattern-aware IDS (GPIDS) against several typical vehicle attacks, including bus-off, spoofing, masquerade, replay, fuzzy, and same origin method execution (SOME). The SOME attack stems from the Internet of Things field and possesses high disguise property, which can mimic physical features as normal messages in IVN, like clock skew, traffic, voltage, and so on. Notably, to the best of our knowledge, we are the first to present an IDS capable of effectively addressing SOME attacks. Extensive experiments have been conducted on four real vehicles, demonstrating that GPIDS can accurately detect the aforementioned attacks with low latency.

With the rapid advancement of digitalization and automation, modern vehicles, especially in the light commercial segment, have evolved into complex, interconnected platforms resembling mobile computing systems. This transformation has increased the dependency on in-vehicle communication networks and, as a result, exposed them to a wider range of cybersecurity threats. A fundamental aspect of the proposed method is the use of a lightweight CNN model specific for deployment in embedded automotive environments with limited computational resources and optimized for efficiency. Operating on low-power hardware platforms such as edge ECUs, the tiny device developed in this study works effectively unlike conventional deep learning architectures seeking high processing power and memory. Despite its minimal computational footprint, the model is capable of accurately distinguishing between legitimate and spoofed communication traffic, as well as detecting a variety of attack forms that target different CAN protocol components. The performance metrics of the model further highlight its effectiveness, achieving a ROC AUC Score of 0.9887, an Accuracy of 0.9887, a Precision of 0.9825, a Recall of 0.9952, and an F1-Score of 0.9888. Particularly for real-time on-vehicle intrusion detection systems, this harmony between performance and efficiency makes the strategy especially important. Just as importantly is the introduction of a specifically produced hybrid dataset, which is fundamental for system evaluation and training. The dataset aggregates synthetic generated attack scenarios with real-world spoofing, injection, and denial-of- service (DoS) conditions using actual CAN traffic acquired from a J1939-compliant light commercial vehicle. Standard 11-bit identities combined with industrial communication protocols help the dataset to reflect real-world vehicle dynamics across several ECUs under various scenarios. The model can learn fine-grained patterns often missed by conventional rule-based or manually engineered approaches by means of the image-like transformation of CAN messages—preserving bit-level and temporal information. In intelligent transportation systems, the lightweight CNN architecture and the strong dataset combine to create a scalable and deployable IDS framework that can improve in-vehicle cybersecurity.

The increasing connectivity of in-vehicle electronic control systems has intensified the need for robust cybersecurity solutions, especially for the Controller Area Network (CAN) bus. This study proposes a deep learning–based Intrusion Detection System (IDS) utilizing a Generative Adversarial Network (GAN) architecture to detect anomalous CAN bus traffic in real time. The GAN model is trained solely on legitimate CAN messages, enabling it to learn the underlying statistical patterns of normal communication without relying on predefined attack signatures. The proposed GAN-IDS demonstrates strong detection performance, achieving an accuracy of 98.7% and an F1-Score of 98.5%, outperforming conventional deep learning baselines. To assess deployment feasibility, the discriminator is optimized using TensorFlow Lite (TFLite) and deployed on a Raspberry Pi 4 integrated with a PiCAN2 interface. Hardware evaluation confirms real-time operation with a low detection latency of 2.9 milliseconds per message sequence. System interpretability is further enhanced through SHapley Additive exPlanations (SHAP), which identify CAN ID, engine torque, and RPM as the most influential features contributing to anomaly classification. The proposed GAN-based IDS offer a scalable, manufacturer-independent, and non-intrusive cybersecurity solution for modern Electric Vehicles. Its combination of high detection performance, real-time hardware deployment, and interpretable decision-making marks a significant step toward more intelligent and resilient security mechanisms for future connected and autonomous vehicles.

The automotive sector is undergoing a significant transformation driven by the proliferation of interconnected sensors and advancements in data processing techniques. Among these, anomaly detection for sensor fault diagnosis in sensor operations is crucial due to the critical nature of the application. The rise of Artificial Neural Networks, particularly Deep Autoencoders, has enabled effective anomaly detection using time series data without relying on physical redundancies or complex methods. Generative Adversarial Networks (GANs), widely known for synthetic image generation, have also shown promise in anomaly detection but have been scarcely applied to measurement sensors. This study explores the preliminary implementation of GAN-based anomaly detection on a motorcycle suspension stroke sensor. Initial results indicate an improvement in detection performance compared to traditional autoencoders.

— As the complexity and sophistication of cyber threats continue to evolve, traditional methods of network anomaly detection fail to identify novel and subtle attacks. In response to this challenge, authors propose a novel approach to network anomaly detection utilizing a Hybrid Convolutional Neural Network (CNN) and Generative Adversarial Network (GAN) architecture. The hybrid model leverages the strengths of both CNN and GAN to enhance the detection of network anomalies. The CNN component is designed to extract high-level features from network traffic data, allowing it to capture complex patterns and relationships within the data. Simultaneously, the GAN component acts as a generator and discriminator, learning to generate normal network traffic patterns and distinguishing anomalies from them. To train the hybrid model, employing a large dataset of labelled network traffic, encompassing both normal and anomalous behavior. During training, the GAN generates synthetic normal traffic, creating a diverse set of normal data to train the CNN and help it generalize better to variations in network traffic. In experiments, the hybrid CNN-GAN model demonstrates superior performance in detecting network anomalies compared to traditional methods. It exhibits a high detection rate while minimizing false positives, making it a promising tool for enhancing network security using MATLAB software. The proposed approach contributes to the ongoing efforts to safeguard critical network infrastructures against evolving cyber threats by harnessing the power of AI-driven anomaly detection.

Communication overhead in federated learning (FL) poses a significant challenge for network anomaly detection systems, where the myriad of client configurations and network conditions can severely impact system efficiency and detection accuracy. While existing approaches attempt to address this through individual optimization techniques, they often fail to maintain the delicate balance between reduced overhead and detection performance. This paper presents an adaptive FL framework that dynamically combines batch size optimization, client selection, and asynchronous updates to achieve efficient anomaly detection. Through extensive profiling and experimental analysis on two distinct datasets-UNSW-NBIS for general network traffic and ROAD for automotive networks-our framework reduces communication overhead by 97.6%; (from 700.0s to 16.8s) compared to synchronous baseline approaches while maintaining comparable detection accuracy (95.10%; vs. 95.12%;). Statistical validation using Mann-Whitney U test confirms significant improvements (p < 0.05) over existing FL approaches across both datasets, demonstrating the framework's adaptability to different network security contexts. Detailed profiling analysis reveals the efficiency gains through dramatic reductions in GPU operations and memory transfers while maintaining robust detection performance under varying client conditions.

Traditional detection techniques are unable to detect novel and subtle attacks as cyber threats become more sophisticated. Convolutional Neural Networks (CNNs) and Generative Adversarial Networks (GANs) are combined in this study to propose a hybrid model that enhances network anomaly detection. While the CNN pulls important patterns from network traffic, the GAN, which was trained on an unstructured dataset, learns usual network behavior, generates false information, and detects irregularities. This technique assists in detecting unexpected threats, such zeroday assaults, by spotting deviations from usual trends. A distinct loss function is applied to discrete network data in order to improve accuracy and reduce false positives. Experimental results on the NSL-KDD dataset show the proposed CNN-GAN model achieves an accuracy of 97%. The model also attains an AUC-ROC score of 0.98, indicating strong discrimination between normal and attack traffic. Developed in MATLAB, this system strengthens network security by offering a dependable and effective real-time cyber threat detection solution.

No abstract available

Automotive electronic control units (ECUs) typically offer less than 32 kB of on-chip flash memory, presenting a significant challenge for deploying deep-learning models for Controller Area Network (CAN bus) intrusion detection systems (IDS). While existing deep learning methods demonstrate high efficiency in threat detection, their complex architectures often render them too resource-intensive for the stringent constraints of automotive ECUs. This paper addresses this critical gap by proposing an efficient methodology for developing an ultra-lightweight CNN-based IDS. Our approach centers on the systematic application and validation of an information-dense RGB tensor encoding for 16-frame CAN windows (adapted from prior work [1]), which effectively captures crucial temporal, identifier, and data-length characteristics. This encoding is coupled with CANET-33K, a novel and compact 32.9k-parameter CNN architecture specifically tailored for these RGB representations, and a one-shot hybrid compression strategy that combines structured pruning with 8-bit post-training quantization (PTQ). The resulting INT8 model achieves a 99.73% overall accuracy and a 0.40% false-negative rate across four common attack types (DoS, Fuzzy, Gear, RPM). Notably, the compressed model is over 420 times smaller than a 7 MB Inception-ResNet baseline and 16 times smaller than recent specialized RGB-CNNs, while maintaining comparable or superior detection performance. These results demonstrate a viable path towards deploying high-performance IDS on resource-constrained automotive hardware.

This study advances Electromagnetic Compatibility (EMC) by investigating how electromagnetic interference (EMI) from Radio Frequency (RF) sources affects digital interconnects. Unlike traditional analyses centered on Continuous Wave (CW) signals, we adopt an RF-focused approach using S-parameter data and consistent RF power to emphasize steady-state responses. This method eliminates the need for time-domain conversions, allowing for more accurate analysis. Our research introduces a novel image-based classification system that accurately assesses signal safety based on steady-state responses. By leveraging a Generative Adversarial Network (GAN) trained on ‘safe’ and ‘unsafe’ signal images, our system can effectively recognize and distinguish between these two states. The GAN’s ability to generate realistic signal patterns enhances classification accuracy, especially when empirical data is limited. This approach has been validated through multiple transformations to ensure robustness and reliability. The findings offer significant improvements in EMC analysis and provide practical guidelines for designing robust digital interconnects. These advancements contribute to enhancing the reliability and security of electronic devices in environments with high RF interference, making them better suited for real-world commercial applications where signal integrity is critical.

In order to solve the problems of long training time, large consumption of computing resources and huge parameter amount of GAN network in image generation, this paper proposes an improved GAN network model, which is named Faster Projected GAN, based on Projected GAN. The proposed network is mainly focuses on the improvement of generator of Projected GAN. By introducing depth separable convolution (DSC), the number of parameters of the Projected GAN is reduced, the training speed is accelerated, and memory is saved. Experimental results show that on ffhq-1k, art-painting, Landscape and other few-shot image datasets, a 20% speed increase and a 15% memory saving are achieved. At the same time, FID loss is less or no loss, and the amount of model parameters is better controlled. At the same time, significant training speed improvement has been achieved in the small sample image generation task of special scenes such as earthquake scenes with few public datasets.

Detecting out-of-distribution (OOD) inputs is pivotal for deploying safe vision systems in open-world environments. We revisit diffusion models, not as generators, but as universal perceptual templates for OOD detection. This research explores the use of score-based generative models as foundational tools for semantic anomaly detection across unseen datasets. Specifically, we leverage the denoising trajectories of Denoising Diffusion Models (DDMs) as a rich source of texture and semantic information. By analyzing Stein score errors, amplified through the Structural Similarity Index Metric (SSIM), we introduce a novel method for identifying anomalous samples without requiring re-training on each target dataset. Our approach improves over state-of-the-art and relies on training a single model on one dataset -- CelebA -- which we find to be an effective base distribution, even outperforming more commonly used datasets like ImageNet in several settings. Experimental results show near-perfect performance on some benchmarks, with notable headroom on others, highlighting both the strength and future potential of generative foundation models in anomaly detection.

This paper presents a novel anomaly detection methodology termed Statistical Aggregated Anomaly Detection (SAAD). The SAAD approach integrates advanced statistical techniques with machine learning, and its efficacy is demonstrated through validation on real sensor data from a Hardware-in-the-Loop (HIL) environment within the automotive domain. The key innovation of SAAD lies in its ability to significantly enhance the accuracy and robustness of anomaly detection when combined with Fully Connected Networks (FCNs) augmented by dropout layers. Comprehensive experimental evaluations indicate that the standalone statistical method achieves an accuracy of 72.1%, whereas the deep learning model alone attains an accuracy of 71.5%. In contrast, the aggregated method achieves a superior accuracy of 88.3% and an F1 score of 0.921, thereby outperforming the individual models. These results underscore the effectiveness of SAAD, demonstrating its potential for broad application in various domains, including automotive systems.

Connected cars are susceptible to cyberattacks. Security and safety of future vehicles highly depend on a holistic protection of automotive components, of which the time-sensitive backbone network takes a significant role. These onboard Time-Sensitive Networks (TSNs) require monitoring for safety and -- as versatile platforms to host Network Anomaly Detection Systems (NADSs) -- for security. Still a thorough evaluation of anomaly detection methods in the context of hard real-time operations, automotive protocol stacks, and domain specific attack vectors is missing along with appropriate input datasets. In this paper, we present an assessment framework that allows for reproducible, comparable, and rapid evaluation of detection algorithms. It is based on a simulation toolchain, which contributes configurable topologies, traffic streams, anomalies, attacks, and detectors. We demonstrate the assessment of NADSs in a comprehensive in-vehicular network with its communication flows, on which we model traffic anomalies. We evaluate exemplary detection mechanisms and reveal how the detection performance is influenced by different combinations of TSN traffic flows and anomaly types. Our approach translates to other real-time Ethernet domains, such as industrial facilities, airplanes, and UAVs.

The challenges derived from the data-intensive nature of machine learning in conjunction with technologies that enable novel paradigms such as V2X and the potential offered by 5G communication, allow and justify the deployment of Federated Learning (FL) solutions in the vehicular intrusion detection domain. In this paper, we investigate the effects of integrating FL strategies into the machine learning-based intrusion detection process for on-board vehicular networks. Accordingly, we propose a FL implementation of a state-of-the-art Intrusion Detection System (IDS) for Controller Area Network (CAN), based on LSTM autoencoders. We thoroughly evaluate its detection efficiency and communication overhead, comparing it to a centralized version of the same algorithm, thereby presenting it as a feasible solution.

The proliferation of IoT devices has significantly increased network vulnerabilities, creating an urgent need for effective Intrusion Detection Systems (IDS). Machine Learning-based IDS (ML-IDS) offer advanced detection capabilities but rely on labeled attack data, which limits their ability to identify unknown threats. Self-Supervised Learning (SSL) presents a promising solution by using only normal data to detect patterns and anomalies. This paper introduces SAFE, a novel framework that transforms tabular network intrusion data into an image-like format, enabling Masked Autoencoders (MAEs) to learn robust representations of network behavior. The features extracted by the MAEs are then incorporated into a lightweight novelty detector, enhancing the effectiveness of anomaly detection. Experimental results demonstrate that SAFE outperforms the state-of-the-art anomaly detection method, Scale Learning-based Deep Anomaly Detection method (SLAD), by up to 26.2% and surpasses the state-of-the-art SSL-based network intrusion detection approach, Anomal-E, by up to 23.5% in F1-score.