CN118802351A - Vehicle charging interface attack detection method, device, equipment and storage medium - Google Patents

Abstract

The invention discloses a vehicle charging interface attack detection method, a device, equipment and a storage medium, wherein the detection method comprises the following steps: judging whether ID information in the received CAN message belongs to a set list or not; judging whether the CAN message accords with a set data frame period according to the ID information; calculating at least one of data load rate, information entropy and abnormal interval message quantity, and comparing with a set threshold value; searching a message processing rule according to the ID information, and judging whether the data segment is abnormal or not; identifying the charging states of the BMS and the charger according to the PGN information, and judging whether the charging states are abnormal or not by comparing the state transition diagram; constructing a data set from the current CAN message and the historical CAN message; and inputting a stacked LSTM residual network, and training a message anomaly detection model to obtain a CAN message classification result. According to the vehicle charging interface attack detection method, potential attack behaviors can be comprehensively detected in real time through fusion detection of multiple detection mechanisms, and charging safety of a vehicle is effectively protected.

Description

Vehicle charging interface attack detection method, device, equipment and storage medium

Technical Field

The present invention relates to the technical field of vehicle charging interface attack detection, and in particular to a vehicle charging interface attack detection method, device, equipment and storage medium.

Background Art

In charging scenarios, electric vehicles communicate with charging piles through the CAN bus to negotiate charging parameters such as charging current and voltage. No secure communication protocol is used for data transmission between the two, resulting in serious information security issues and facing potential network security attacks at all times.

Using the CAN bus for communication faces serious risks of data monitoring, data tampering, and node impersonation. Some manufacturers will set up two-way identity authentication to improve information security, which can solve the problem of node impersonation during communication and enable the vehicle and charging pile to negotiate the session key required for subsequent encryption, but it cannot solve the problem of encryption and integrity verification of communication data.

The charging interface of the vehicle is still at risk of being attacked. For example, the CAN bus using priority arbitration is vulnerable to denial of service (DOS) attacks. The attacker only needs to control any ECU to send high-speed, high-priority ID messages to the network where it is located. By sending a large number of high-priority messages at a high frequency to occupy the bus resources, the nodes on the network cannot send messages, causing the bus to be paralyzed. Furthermore, the attacker can also perform injection attacks on the CAN bus by modifying the ID and data fields in the CAN data frame.

Summary of the invention

The purpose of the present invention is to provide a vehicle charging interface attack detection method, device, equipment and storage medium, which can detect potential attack behaviors in real time and comprehensively through the fusion detection of multiple detection mechanisms, and effectively protect the charging safety of the vehicle.

In order to achieve the above object, the present invention discloses a vehicle charging interface attack detection method, the CAN message includes ID information, PGN information and data segment, and the detection method includes:

Determine whether the ID information in the received CAN message belongs to the set list;

Determine whether the CAN message complies with a set data frame period according to the ID information;

Calculate at least one of the data load rate, information entropy and abnormal interval message volume in the CAN bus, and compare with the corresponding set value to determine whether there is a denial of service attack;

Searching for a corresponding message processing rule from a rule base according to the ID information, and judging whether the data segment is abnormal according to the searched message processing rule;

Identify the current charging status of the BMS and charger of the vehicle battery according to the PGN information, and determine whether the charging status is abnormal by comparing the state transition diagram;

The current CAN messages and historical CAN messages are combined into a data set;

The assembled data set is input into a stacked LSTM residual network, and a message anomaly detection model is trained to obtain a CAN message classification result;

If you find any abnormal situation, do at least one of the following:

Send out warning signals;

Discard the current CAN message and terminate the remaining detection;

Terminates the communication and stops the remaining detection.

Furthermore, the “calculating at least one of the data load rate, information entropy and abnormal interval message volume in the CAN bus, and comparing with the corresponding set value to determine whether there is a denial of service attack” includes:

Counting the number of CAN messages transmitted in the CAN bus per unit time, calculating the current transmission rate of the CAN bus, and comparing the current transmission rate with the transmission rate threshold. When the current transmission rate is greater than the transmission rate threshold, it is determined that a denial of service attack exists; and/or,

Detect the current information entropy of the CAN bus using a multi-entropy algorithm and compare it with the corresponding information entropy threshold in the threshold sample library. When the information entropy is greater than the information entropy threshold, it is determined that a denial of service attack exists; and/or,

Calculate the interval time between the transmission of two adjacent CAN messages, and count the number of times the interval time is less than the preset interval time. When the counted number is greater than the preset number, it is determined that a denial of service attack exists.

Furthermore, the “forming a data set from current CAN messages and historical CAN messages” includes:

Extract the ID information and data segments in the current CAN message and the historical CAN message as input data;

Normalizing the extracted input data;

Perform stationarity test on the normalized input data;

Stabilize the input data detected as unstable;

Classify all processed input data and label them accordingly.

Furthermore, the step of “inputting the assembled data set into a stacked LSTM residual network and training a message anomaly detection model to obtain a CAN message classification result” includes:

The parameters of the message anomaly detection model are optimized using a genetic algorithm to optimize the CAN message classification result.

In order to achieve the above object, the present invention discloses a vehicle charging interface attack detection device, which includes:

The first judgment module is used to judge whether the ID information in the received CAN message belongs to the set list;

A second judgment module is used to judge whether the CAN message conforms to a set data frame period according to the ID information;

A calculation and comparison module, used to calculate at least one of the data load rate, information entropy and abnormal interval message volume in the CAN bus, and compare it with the corresponding set value to determine whether there is a denial of service attack;

A search and judgment module, used to search for a corresponding message processing rule from a rule base according to the ID information, and judge whether the data segment is abnormal according to the searched message processing rule;

An identification and judgment module, used to identify the current charging status of the BMS and charger of the vehicle battery according to the PGN information, and judge whether the charging status is abnormal by comparing the state transition diagram;

A building module is used to build a data set from current CAN messages and historical CAN messages;

The training module is used to input the assembled data set into a stacked LSTM residual network and perform message anomaly detection model training to obtain CAN message classification results.

In order to achieve the above object, the present invention discloses an electronic device, which includes:

one or more processors;

One or more memories are used to store one or more programs. When one or more of the programs are executed by the processor, the processor implements the vehicle charging interface attack detection method as described above.

In order to achieve the above-mentioned purpose, the present invention discloses a computer-readable storage medium having a program stored thereon, and when the program is executed by a processor, the vehicle charging interface attack detection method as described above is implemented.

In the present application, multiple detection operations are performed to detect and determine whether the vehicle charging interface is attacked. First, it is determined whether the received CAN message belongs to the set list and whether it conforms to the set data frame period; at least one of the data load rate, information entropy and abnormal interval message volume in the CAN bus is calculated to determine whether the CAN bus is attacked by denial of service; according to the message processing rules in the rule base, it is determined whether the data segment of the CAN message is abnormal; according to the state transition diagram, it is determined whether the current charging status of the BMS and charger of the vehicle battery is abnormal, and the stacked LSTM residual network is used to train the message anomaly detection model for the current CAN message and the historical CAN message to obtain the CAN message classification result, and then through the fusion detection of the above-mentioned multiple detection mechanisms, real-time and comprehensive detection of potential attack behaviors is achieved, effectively protecting the charging safety of the vehicle.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flow chart of a vehicle charging port attack detection method according to an embodiment of the present invention.

FIG. 2 is a state transition diagram of a vehicle charging port attack detection method according to an embodiment of the present invention.

FIG3 is a schematic diagram of charging status identification in a vehicle charging port attack detection method according to an embodiment of the present invention.

FIG4 is a schematic diagram of a message anomaly detection model in a vehicle charging interface attack detection method according to an embodiment of the present invention.

FIG5 is a module diagram of a vehicle charging port attack detection device according to an embodiment of the present invention.

FIG. 6 is a system diagram of an electronic device according to an embodiment of the present invention.

DETAILED DESCRIPTION

In order to explain the technical content, structural features, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

Embodiment 1

Please refer to Figures 1 to 4. The present invention discloses a vehicle charging interface attack detection method. The CAN message includes ID information, PGN information and a data segment.

It should be noted that the CAN message is a CAN bus data frame structure whose main fields include a punching segment (CAN ID), a data segment and a CRC segment for data verification, but is not limited thereto.

Detection methods include:

101. Determine whether the ID information in the received CAN message belongs to the set list;

It can be understood that the ID information is obtained from the arbitration segment of the CAN message, and the set list includes a white list and a black list. The white list records completely credible messages, and the black list records information that is expressly prohibited. If the ID information is detected in the white list, the CAN message is released to perform the next detection. If the ID information is detected in the black list, 112 is executed to discard the current CAN message and terminate the execution of the remaining detection operations. By comparing the black list and the white list, it is beneficial to realize efficient and real-time rapid filtering and detection of CAN messages, but it is not limited to this.

102. Determine whether the CAN message complies with the set data frame period according to the ID information;

It can be understood that the data frame cycle detection is for the periodic CAN message messages transmitted between the vehicle and the charging pile in the CAN bus for the charging scenario. Therefore, it is only necessary to compare the data frame cycle of the CAN message of a specific ID information with the data frame cycle of the CAN message of the ID information in the normal communication state. For example, a CAN message of a certain ID information is sent once every 3 data frames, while a CAN message of another ID information is sent once every 5 data frames, etc. Therefore, it is possible to determine whether the CAN message has a cycle abnormality through the ID information of the CAN message. It is helpful to detect a small amount of injection attacks and a large amount of Dos attacks, but not limited to this.

103. Calculate at least one of the data load rate, information entropy, and abnormal interval message volume in the CAN bus, and compare with the corresponding set value to determine whether there is a denial of service attack;

The bus load rate, information entropy and repeated frame interval time are used to detect the possible denial of service (DoS) attacks on the CAN bus. This can not only detect specific DoS attacks, but also achieve complementary detection and comprehensively detect multiple DoS attacks.

Furthermore, “calculating at least one of the data load rate, information entropy and abnormal interval message volume in the CAN bus, and comparing with the corresponding set value to determine whether there is a denial of service attack” includes:

1031. Count the number of CAN messages transmitted in the CAN bus within a unit time, calculate the current transmission rate of the CAN bus, and compare the current transmission rate with the transmission rate threshold. When the current transmission rate is greater than the transmission rate threshold, it is determined that a denial of service attack exists; and/or,

CAN bus load rate detection can detect attacks of massive CAN message injection in real time and efficiently.

It is understandable that the CAN bus load rate refers to the percentage of the current message transmission rate to the maximum transmission rate of the CAN bus. Under normal communication conditions, the message transmission rate will remain below the transmission rate threshold. When the message transmission rate exceeds the transmission rate threshold, it can be determined that there is an abnormality in the CAN bus network, which may be caused by the attacker sending a large number of junk messages. Then, operation 111 can be executed to send an alarm signal or operation 113 can be executed to terminate the communication and terminate the execution of the remaining detection, but this is not limited to this.

1032. Detect the current information entropy of the CAN bus using a multi-entropy algorithm, and compare it with the corresponding information entropy threshold in the threshold sample library. When the information entropy is greater than the information entropy threshold, it is determined that a denial of service attack exists; and/or,

It is understandable that the more chaotic a system is, the higher its information entropy is. The data flowing in the CAN bus has periodic regularity. Under normal circumstances, at a certain time point, the information entropy of the CAN bus is a constant value. When the information entropy fluctuates, it means that there are CAN messages in the CAN bus that violate the system's predetermined settings. There may be malicious nodes or external attacks. Therefore, the detection of information entropy is for periodic CAN messages in the CAN bus.

It should be noted that when using the multi-entropy algorithm to detect whether the CAN bus is under flood attack, it is first necessary to use the multi-entropy algorithm to offline train the message data of the normal on-board CAN bus network to obtain the threshold sample library, and then use the multi-entropy algorithm to perform statistical analysis on the CAN message data in the on-board CAN bus network to be detected to calculate the information entropy of the current CAN bus network, and select the appropriate information entropy threshold in the threshold sample library based on the statistical analysis for comparison, so as to effectively determine whether the information entropy of the CAN bus is abnormal.

1033. Calculate the interval time between transmitting two adjacent CAN messages, and count the number of times the interval time is less than a preset interval time. When the counted number is greater than the preset number, it is determined that a denial of service attack exists.

It can be understood that the detection of the amount of abnormal interval messages is for all CAN messages in the CAN bus. The preset interval time is a specific millisecond value. The amount of abnormal interval messages is counted by counting the time intervals between the reception of the previous and next messages. When the amount of abnormal interval messages exceeds the set abnormal threshold, it is determined that a Dos attack has occurred, but this is not limited to this.

104. Search the corresponding message processing rule from the rule base according to the ID information, and determine whether the data segment is abnormal according to the searched message processing rule;

It should be noted that the data segment of the CAN message carries multiple signal values, and the corresponding information values are within a certain range or are specific values. If the received CAN frame signal value exceeds the specific range or is not a specific value, it can be judged that the data segment of the CAN message is abnormal, and operation 111 is executed to send an alarm signal to prompt the current risk of the charging interface and enter the next detection operation, but it is not limited to this.

It can be understood that the rule base stores message processing rules classified by ID information for data abnormality judgment and disposal. The message processing rules include detection rules and processing action options. The CAN message is matched with the CAN frame data length and the rule option field according to the detection rules. If it meets the requirements, the next detection operation is entered. Otherwise, operation 111 is executed to send an alarm signal, and a blocking operation is performed according to the processing action options.

For example, in a charging scenario, when it is detected that the ID information of the current CAN message is 0x123, it means that the CAN message is a charging data frame. The data field of the CAN message carries data segments such as the charging current. Then, the message processing rule with the ID information of 0x123 is directly searched from the rule base, and the CAN message is abnormally judged and processed according to the message processing rule (for example, the current exceeding 300A is judged as the charging current is too high, etc.).

105. Identify the current charging status of the vehicle battery's BMS and charger based on the PGN information, and determine whether the charging status is abnormal by comparing it with the state transition diagram;

State transition anomaly detection can detect events that violate normal operating behaviors, which is helpful to improve the comprehensiveness of detecting charging interface attack behaviors.

It should be noted that the charging pile adopts the GB/T 27930 standard to regulate the communication process and content. According to the charging standard, during the charging process, the charger of the charging pile and the BMS of the vehicle have behavioral state conversion. The behavioral state indicates the state of the BMS of the vehicle and the charger of the charging pile in the process of processing the vehicle-pile communication protocol, for example, waiting state, ready state, etc.; therefore, by collecting different orders of multiple CAN frames, using the behavioral state machine to record multiple CAN frame sequences, and then constructing the operating state of the charger and BMS when charging is normal, the state transition diagram shown in Figure 2 is obtained (the actual state conversion is not fully indicated, and the actual reference charging standard is used).

It can be understood that the PGN information is parsed from the punched segment (ID) of the CAN message, and the CAN message is identified as shown in Figure 3. After receiving a certain or multiple CAN messages in a specific order (receiving stimulation), it can be determined that the state of the charger and the BMS has changed, and the current charging state is matched with the behavior state machine to monitor in real time whether the current charging state deviates from the normal state machine model, so as to realize intrusion detection based on the state machine. When an illegal CAN frame sequence is detected and it is found that the state transition is not performed according to the preset state transition diagram, it can be determined that the current charging state has entered an abnormal state of the state machine, and it is regarded as a threat and a potential security risk. Then, operation 112 is executed to discard the current CAN message and terminate the execution of the remaining detections.

106. The current CAN message and the historical CAN message are formed into a data set;

Furthermore, "forming a data set of current CAN messages and historical CAN messages" includes:

1061. Extracting ID information and data segments from the current CAN message and the historical CAN message as input data;

It is understandable that attacks on the CAN bus are mostly manifested as manipulating the punching segment (ID) and data segment in the data frame of the CAN message. Therefore, the ID information and data segment of the CAN message are used as the input data features of the model, but not limited to this.

1062. Normalizing the extracted input data;

Normalization is used to limit the input data to a certain range to eliminate the influence of special data features, which is conducive to accelerating the convergence speed of the gradient descent model.

1063. Perform a stationarity test on the normalized input data;

1064. Performing stabilization processing on the input data detected as unstable;

It is understandable that the stabilization process includes the use of differentiation, transformation, decomposition and the like.

1065. Classify all processed input data and label them accordingly.

For example, tags such as normal messages, DoS attack messages, and abnormal signal value messages are added to the input data to form a data set that can be used for training and testing.

107. Input the assembled data set into the stacked LSTM residual network and train the message anomaly detection model to obtain the CAN message classification results.

Deep detection technology based on deep learning can effectively detect injection attack behaviors, which is helpful to protect electric vehicle charging interfaces from attacks.

It can be understood that, as shown in Figure 4, using a stacked LSTM residual network to train a message anomaly detection model for current CAN message information and historical CAN message information can achieve end-to-end model training to directly output the abnormal classification results of the CAN message, and perform operation 111 to send an alarm signal or operation 113 to terminate communication based on the abnormal classification results, thereby realizing context-based CAN bus anomaly detection, but not limited to this.

It is understandable that the LSTM network can solve the gradient vanishing problem of the traditional RNN network in CAN message sequence processing to capture the historical CAN message information at an earlier time. On this basis, a stacked LSTM network is set to increase the complexity of the model to comprehensively learn and extract the features of complex message sequences, and residual links are introduced to solve the problem of model training difficulties caused by the increase in model complexity. The stacked LSTM residual network is set with hidden layers and recurrent layers to extract the features of high-dimensional input data. Usually, the hidden layer is used as a general multi-layer perceptron to extract the general features of the data, and the recurrent layer is used to extract the time features of the data or the time-sequential correlation features, but not limited to this.

Furthermore, “inputting the assembled data set into the stacked LSTM residual network and training the message anomaly detection model to obtain the CAN message classification result” includes:

108. The genetic algorithm is used to optimize the parameters of the message anomaly detection model to optimize the CAN message classification results.

It can be understood that the parameters of the message anomaly detection model include neural network model parameters such as weights and biases, and optimizing them using genetic algorithms is conducive to achieving the optimal detection effect of the message anomaly detection model training.

If you find any abnormal situation, do at least one of the following:

111. Send out warning signals;

112. Discard the current CAN message and terminate the remaining detection;

113. Terminate the communication and terminate the remaining detection.

Making necessary warnings and/or blocking operations based on the attack behaviors detected in real time is conducive to establishing a safety protection mechanism for the charging interface.

It can be understood that operation 101 is a black and white list detection, operation 102 is a data frame period detection, operation 103 is a data domain detection, operation 104 is a denial of service attack detection, operation 105 is a state transition detection, operations 106 and 107 are deep detection based on deep learning. In this embodiment, the above detection operations are performed in sequence, and each detection is evaluated whether there is an abnormal situation. If the detection passes, the next detection is performed in sequence. If an abnormal situation is detected, at least one operation of operations 111 to 113 is performed according to the actual situation, but it is not limited to this.

In the present application, multiple detection operations are performed to detect and determine whether the vehicle charging interface is attacked. First, it is determined whether the received CAN message belongs to the set list and whether it conforms to the set data frame period; at least one of the data load rate, information entropy and abnormal interval message volume in the CAN bus is calculated to determine whether the CAN bus is attacked by denial of service; according to the message processing rules in the rule base, it is determined whether the data segment of the CAN message is abnormal; according to the state transition diagram, it is determined whether the current charging status of the BMS and charger of the vehicle battery is abnormal, and the stacked LSTM residual network is used to train the message anomaly detection model for the current CAN message and the historical CAN message to obtain the CAN message classification result, and then through the fusion detection of the above-mentioned multiple detection mechanisms, real-time and comprehensive detection of potential attack behaviors is achieved, effectively protecting the charging safety of the vehicle.

Embodiment 2

Referring to FIG. 1 and FIG. 5 , the present invention discloses a vehicle charging interface attack detection device, which includes:

The first judgment module 201 is used to judge whether the ID information in the received CAN message belongs to the set list;

The second judgment module 202 is used to judge whether the CAN message conforms to the set data frame period according to the ID information;

A calculation and comparison module 203 is used to calculate at least one of the data load rate, information entropy and abnormal interval message volume in the CAN bus, and compare it with the corresponding set value to determine whether there is a denial of service attack;

A search and judgment module 204 is used to search for a corresponding message processing rule from a rule base according to the ID information, and judge whether the data segment is abnormal according to the searched message processing rule;

The identification and judgment module 205 is used to identify the current charging status of the BMS and charger of the vehicle battery according to the PGN information, and to judge whether the charging status is abnormal by comparing the state transition diagram;

A building module 206, used for building a data set from current CAN messages and historical CAN messages;

The training module 207 is used to input the assembled data set into the stacked LSTM residual network and perform message anomaly detection model training to obtain CAN message classification results.

Embodiment 3

Referring to FIG. 1 and FIG. 6 , the present invention discloses an electronic device, which includes:

One or more processors 301;

One or more memories 302 are used to store one or more programs. When the one or more programs are executed by the processor, the processor implements the vehicle charging interface attack detection method as described above.

Embodiment 4

An embodiment of the present application discloses a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the vehicle charging interface attack detection method as described above is implemented.

Embodiment 5

The embodiment of the present application discloses a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device executes the above-mentioned vehicle charging interface attack detection method.

It should be understood that in the embodiments of the present application, the processor referred to may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by hardware related to computer program instructions, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM).

The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. Therefore, equivalent changes made according to the scope of the patent application of the present invention are still within the scope covered by the present invention.

Claims (7)

1. The method for detecting the attack of the charging interface of the vehicle is characterized in that a CAN message comprises ID information, PGN information and a data segment, and comprises the following steps:

Judging whether ID information in the received CAN message belongs to a set list or not;

judging whether the CAN message accords with a set data frame period according to the ID information;

Calculating at least one of data load rate, information entropy and abnormal interval message quantity in the CAN bus, and comparing the data load rate, the information entropy and the abnormal interval message quantity with corresponding set thresholds to judge whether denial of service attack exists or not;

searching a corresponding message processing rule from a rule base according to the ID information, and judging whether the data segment is abnormal according to the searched message processing rule;

Identifying the current charging states of the BMS and the charger of the vehicle battery according to the PGN information, and judging whether the charging states are abnormal or not according to a state transition diagram;

constructing a data set from the current CAN message and the historical CAN message;

Inputting the constructed data set into a stacked LSTM residual network, and training a message anomaly detection model to obtain a CAN message classification result;

when any abnormal situation is found, at least one of the following operations is executed:

Sending out an alarm signal;

discarding the current CAN message, and terminating execution of the residual detection;

the communication is terminated and the execution of the remaining detection is terminated.

2. The method of claim 1, wherein calculating at least one of a data load rate, an information entropy, and an abnormal interval message amount in the CAN bus and comparing the calculated data load rate, the information entropy, and the abnormal interval message amount with corresponding set values to determine whether a denial of service attack exists comprises:

Counting the number of CAN messages transmitted in a CAN bus in unit time, calculating the current transmission rate of the CAN bus, comparing the current transmission rate with a transmission rate threshold, and judging that denial of service attack exists when the current transmission rate is greater than the transmission rate threshold; and/or the number of the groups of groups,

Detecting the current information entropy of the CAN bus by utilizing a multi-entropy algorithm, comparing the current information entropy with a corresponding information entropy threshold value in a threshold value sample library, and judging that denial of service attack exists when the information entropy is larger than the information entropy threshold value; and/or the number of the groups of groups,

Calculating the interval time of transmitting two adjacent CAN messages, counting the times that the interval time is smaller than the preset interval time, and judging that denial of service attacks exist when the counted times are larger than the preset times.

3. The method for detecting an attack on a vehicle charging interface according to claim 1, wherein the step of constructing a data set from a current CAN message and a history CAN message includes:

Extracting ID information and data segments in a current CAN message and a historical CAN message as input data;

Normalizing the extracted input data;

Carrying out stability detection on the input data after normalization processing;

Performing stabilization processing on input data detected as unstable;

And classifying and marking all the processed input data with corresponding labels.

4. The method for detecting the attack of the vehicle charging interface according to claim 1, wherein the step of inputting the constructed data set into the stacked LSTM residual network and training the message anomaly detection model to obtain the CAN message classification result comprises the following steps:

and optimizing parameters of the message anomaly detection model by utilizing a genetic algorithm so as to optimize the CAN message classification result.

5. A vehicle charging interface attack detection device, comprising:

The first judging module is used for judging whether the ID information in the received CAN message belongs to a set list or not;

the second judging module is used for judging whether the CAN message accords with a set data frame period according to the ID information;

The calculation comparison module is used for calculating at least one of the data load rate, the information entropy and the abnormal interval message quantity in the CAN bus and comparing the data load rate, the information entropy and the abnormal interval message quantity with corresponding set values so as to judge whether denial of service attack exists or not;

the searching and judging module is used for searching corresponding message processing rules from the rule base according to the ID information and judging whether the data segment is abnormal according to the searched message processing rules;

the identification judging module is used for identifying the current charging states of the BMS of the vehicle battery and the charger according to the PGN information, and judging whether the charging states are abnormal or not according to a state transition diagram;

The construction module is used for constructing a data set from the current CAN message and the historical CAN message;

the training module is used for inputting the constructed data set into a stacked LSTM residual network and training a message anomaly detection model to obtain a CAN message classification result.

6. An electronic device, comprising:

One or more processors;

One or more memories for storing one or more programs which, when executed by the processor, cause the processor to implement the vehicle charging interface attack detection method according to any of claims 1 to 4.

7. A computer-readable storage medium having a program stored thereon, wherein the program when executed by a processor implements the vehicle charging interface attack detection method according to any one of claims 1 to 4.