The invention discloses a vehicle-based intrusion detection method, device and
system and a storage medium, and the method comprises the steps: capturing
log data of a target
system event based on an eBPF program running in a vehicle operation
system kernel, and constructing N to-be-detected sequences based on the captured
log data;
processing the N to-be-detected sequences based on a preset
attack discrimination model deployed in the vehicle to obtain an initial type corresponding to each to-be-detected sequence; all the M to-be-detected sequences of which the initial types are abnormal types are uploaded to a cloud end, and known
attack type identification is performed on the M to-be-detected sequences through the cloud end; k to-be-detected sequences are screened out from the to-be-detected sequences of which the initial types are normal types, the K to-be-detected sequences are uploaded to a cloud end, unknown
attack type identification is carried out on the K to-be-detected sequences through the cloud end, and N, M and K are positive integers. According to the scheme, vehicle intrusion detection can be comprehensively and accurately realized.