Abstract: The controller area network (CAN) bus in the vehicle is vulnerable to attacks due to the lack of security measures. Therefore, intrusion detection systems (IDS) play an important role in protecting the CAN bus in the vehicle from network attacks. The existing vehicle CAN bus intrusion detection methods based on deep learning have the problems of high resource consumption and high latency. To reduce detection latency and improve detection rate, an improved lightweight MobileViT model is proposed for intrusion detection on the vehicle CAN bus. First, visualize the attack traffic as a color map, and then use GELU to replace the regular ReLU6 in the MV2 module in MobileViT, which serves as the activation function of the MV2 module, effectively solving the problem of neuron death and improving the convergence speed of the MobileViT mode. Use exponential decay to automatically update the learning rate and accelerate the training process through transfer learning to implement color image classification so as to achieve intrusion detection. Experiments based on the CARHAKING DATASET show that the improved MobileViT has a detection accuracy of 100% for intrusion behavior with less computational power consumption, model parameters of only 2.12MB, and an average response time of only 1.6ms, saving training resources and ensuring detection accuracy.

Key words: intrusion detection, vehicle cyber security, lightweight, MobileViT, CAN(controller area network) bus

摘要： 车载控制区域网络(controller area network, CAN)总线因缺少安全措施而易被攻击，因此入侵检测系统(intrusion detection system, IDS)在保护车载CAN总线免受网络攻击中发挥着重要作用.现有基于深度学习的车载CAN总线入侵检测方法存在资源开销大和延迟较高的问题.为减少检测延迟，提高检测率，提出一种利用改进的轻量化MobileViT模型对车载CAN总线进行入侵检测的方法.首先，将攻击流量可视化为彩色图，再使用GELU替换MobileViT的MV2模块中常规ReLU6，从而作为该模块的激活函数，可有效解决神经元死亡问题，提升模型收敛速度.使用指数衰减自动更新学习率，并通过迁移学习加速训练过程实现对彩色图分类，从而达到对入侵行为的检测.基于CARHACKING DATASET数据集的实验表明，改进后的MobileViT在消耗较少算力的情况下对入侵行为的检测准确率为100%，模型参数仅为2.12MB，平均响应时间仅为1.6ms，节省了训练资源，并保证了检测的准确率.

关键词: 入侵检测, 车载网络安全, 轻量化, MobileViT, CAN总线