Vehicle end data processing method, monitoring system, domain controller, medium and product

Abstract

The invention relates to the technical field of Internet of Vehicles, and discloses a vehicle end data processing method, a monitoring system, a domain controller, a medium and a product. The method comprises the following steps: acquiring a data packet monitoring program corresponding to a vehicle end network and an original socket; loading the data packet monitoring program to a kernel mode space, and binding the data packet monitoring program with the original socket to obtain a target socket; and monitoring each network data packet passing through the target socket, filtering out the target data packet from each network data packet by using the data packet monitoring program, and reading data in the target data packet to the user mode space. By implementing the technical scheme of the invention, memory resources are saved, the performance overhead is saved, the flexibility of data packet filtering is improved, the running stability and running safety of the vehicle-side operating system are improved, and the running effect of the vehicle-side operating system is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle networking, and in particular to a vehicle-side data processing method, a monitoring system, a domain controller, a medium and a product. Background Art

[0002] With the development of Internet of Vehicles technology, vehicle intelligence is developing day by day, and vehicle-side networks are receiving more and more attention. The network data packets generated in the vehicle-side network play an important role in vehicle-side network security analysis and network troubleshooting. At present, the capture of vehicle-side network data packets is mostly done through network sniffing tools, such as network data packet capture tool Tcpdump, network protocol analysis tool Wireshark, etc. However, the use of network sniffing tools has problems such as high performance overhead and lack of flexibility, which affects the operating stability of the vehicle-side operating system. Summary of the invention

[0003] In view of this, the present invention provides a vehicle-side data processing method, a monitoring system, a domain controller, a medium and a product to solve the problem that the network data packet capture effect is poor and affects the operation effect of the vehicle-side system.

[0004] In a first aspect, the present invention provides a method for processing vehicle-side data, including: obtaining a data packet monitoring program and a raw socket corresponding to the vehicle-side network; loading the data packet monitoring program into the kernel state space, and binding the data packet monitoring program to the raw socket to obtain a target socket; monitoring each network data packet passing through the target socket, using the data packet monitoring program to filter out a target data packet from each network data packet, and reading the data in the target data packet into the user state space.

[0005] In an optional implementation, obtaining a data packet monitoring program corresponding to the vehicle-side network includes: obtaining a capture strategy for vehicle-side network data packets; and obtaining the data packet monitoring program in response to a program editing operation based on the capture strategy.

[0006] In an optional implementation, obtaining the original socket corresponding to the vehicle-side network includes: obtaining the vehicle-side network interface where the data packet to be monitored is located; and binding the original socket to the vehicle-side network interface.

[0007] In an optional implementation, each network data packet passing through the target socket is monitored, a target data packet is filtered out from each network data packet using a data packet monitoring program, and data in the target data packet is read into a user state space, including: performing port detection on each network data packet to determine the port information of the network data packet; if the port information satisfies the target filtering rule corresponding to the data packet monitoring program, the network data packet is determined as a target data packet; and data is read from the target data packet into a user state space.

[0008] In an optional embodiment, data is read from a target data packet to a user state space, including: obtaining a first data length of the target data packet and a second data length corresponding to a data packet monitoring program; when the second data length is less than the first data length, intercepting data of the target data packet according to the second data length to obtain target data; and reading the target data to a user state space.

[0009] In an optional implementation, the target data is read into the user state space, including: detecting whether the data packet monitor captures the target data packet in the kernel state space; if the data packet monitor captures the target data packet in the kernel state space, reading the target data from the target data packet and passing the target data to the user state space.

[0010] In an optional implementation, the method further includes: analyzing the target data to obtain data analysis results; packaging the data analysis results according to a preset data format to obtain packaged data, and caching the packaged data.

[0011] In an optional embodiment, the encapsulated data is cached, including: saving the encapsulated data to a first-level cache space; and / or, reading the encapsulated data from the first-level cache space to a second-level cache space according to a first preset cycle; and / or, compressing the encapsulated data in the second-level cache space according to a second preset cycle to obtain compressed data, and storing the compressed data in a third-level cache space.

[0012] In an optional implementation, the method further includes: detecting whether the vehicle end is powered off; if the vehicle end is in a powered off state, immediately triggering the saving of the encapsulated data from the first-level cache space to the second-level cache space.

[0013] In a second aspect, the present invention provides a vehicle-side data monitoring system, comprising: a vehicle-side, used to execute the vehicle-side data processing method of the above-mentioned first aspect or any corresponding embodiment; a cloud end, which is communicated with the vehicle-side and is used to configure monitoring information and cache information of the vehicle-side data.

[0014] In a third aspect, the present invention provides a vehicle domain controller, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the vehicle-side data processing method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0015] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the vehicle-side data processing method of the above-mentioned first aspect or any corresponding embodiment thereof.

[0016] In a fifth aspect, the present disclosure provides a computer program product, including computer instructions, which are used to enable a computer to execute the method for processing vehicle-side data of the above-mentioned first aspect or any corresponding embodiment.

[0017] The vehicle-side data processing method, monitoring system, domain controller, medium and product provided by the embodiment of the present invention load a data packet monitoring program in the kernel state space and bind the data packet monitoring program to the original socket, so that all network data packets passing through the original socket will be captured by the data packet monitoring program, and the data packet monitoring program can filter and process the various network data packets it obtains to filter out the required target data packets, avoid capturing useless data packets, and save memory resources. Moreover, the data packet monitoring program can process the target data packets it captures in the kernel state space, without the need to process the target data packets in the user state space during transmission, saving performance overhead. At the same time, the data packet monitoring program can accurately filter specific types of target data packets, improving the flexibility of data packet filtering. Thereby, it is conducive to improving the operating stability and operating security of the vehicle-side operating system and ensuring the operating effect of the vehicle-side operating system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 is a flow chart of a method for processing vehicle-side data according to an embodiment of the present invention;

[0020] Figure 2 is a flow chart of another method for processing vehicle-side data according to an embodiment of the present invention;

[0021] Figure 3 is a flow chart of another method for processing vehicle-side data according to an embodiment of the present invention;

[0022] Figure 4 is a schematic diagram of capturing and processing a target data packet according to an embodiment of the present invention;

[0023] Figure 5 is a structural block diagram of a vehicle-side data monitoring system according to an embodiment of the present invention;

[0024] Figure 6 It is a schematic diagram of the hardware structure of a vehicle domain controller according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0026] The capture of vehicle-side network data packets is mostly achieved through network sniffing tools, but network sniffing tools have problems such as high performance overhead and insufficient flexibility. Taking the capture of DNS data packets as an example, many malware and attackers use DNS to establish communication channels, leak data or control infected devices. Capturing DNS data packets can help detect abnormal DNS requests and responses and identify potential security threats. In addition, attackers may redirect users to visit malicious websites through DNS hijacking or DNS spoofing technology. Capturing DNS data packets and analyzing their traffic can help detect and defend against such attacks.

[0027] DNS resolution delays may cause users to access websites more slowly. By analyzing the data traffic of DNS packets, we can identify bottlenecks in the network, optimize the resolution process, and improve user experience. If DNS resolution fails or errors occur in the network, capturing DNS packets can help locate the root cause of the problem, such as DNS server configuration errors or network transmission problems. It can be seen that accurate capture of DNS packets is crucial.

[0028] Currently, the message data carried by DNS packets is mainly captured or analyzed in real time through user-mode software such as Wireshark and Tcpdump; or, the DNS packets are captured by configuring the mirror ports of hardware devices such as switches and routers to copy the traffic.

[0029] However, the above data packet capture method has the following defects:

[0030] (1) User-mode software will occupy a large amount of memory resources. Since it cannot accurately filter network data packets, it will capture a large number of useless network data packets, resulting in a waste of memory resources.

[0031] (2) User-mode software needs to copy captured data packets from kernel-mode space to user-mode space, wasting CPU resources and causing performance degradation. Moreover, in high-traffic environments, this will result in large performance overhead and may affect the normal operation of the system.

[0032] (3) Whether it is user-state software or hardware devices, a large amount of data needs to be transferred to the user-state space for data analysis, which increases the risk of sensitive data exposure and potential leakage.

[0033] It can be seen that the effect of capturing network data packets through network sniffing tools and hardware devices is not ideal. However, in the process of building a communication channel between the vehicle and the cloud, monitoring of network data packets is crucial.

[0034] Based on this, the technical solution of the present invention captures network data packets based on eBPF technology, which has the advantages of high efficiency, flexibility, security and low overhead, and is particularly suitable for real-time network traffic monitoring and analysis in performance-sensitive scenarios.

[0035] Specifically, the eBPF program is loaded into the kernel space, and the network packets are filtered and processed in the kernel space through the eBPF program. Since the eBPF program can run directly in the kernel, compared with network sniffing tools, its way of capturing and processing packets is more efficient, and there is no need to copy data from the kernel space to the user space, which reduces the overhead of context switching and data copying, and greatly improves performance. In contrast, tools such as Wireshark and Tcpdump capture packets in user mode, which may cause performance bottlenecks due to high-frequency packet capture.

[0036] eBPF programs can accurately filter specific types of traffic (such as DNS packets) and support dynamic updates and debugging. In contrast, the filtering capabilities of tools such as Wireshark and Tcpdump are relatively limited, especially when dealing with complex network traffic, their filtering capabilities are difficult to meet the needs.

[0037] eBPF programs allow you to write custom logic to process and analyze data directly when network packets are captured. In contrast, tools such as Wireshark and Tcpdump require secondary processing after capturing network packets.

[0038] Moreover, the security model of eBPF programs is very strict. The kernel will verify when loading eBPF programs to ensure that the programs will not cause crashes or security issues. In contrast, tools such as Wireshark and Tcpdump may cause security vulnerabilities if they are not handled properly, especially when running with high privileges.

[0039] eBPF programs are suitable for real-time monitoring of network traffic, have low overhead, and are suitable for long-term operation in production environments. However, tools such as Wireshark and Tcpdump may generate a large amount of data when running for a long time, resulting in increased storage and processing burdens.

[0040] The embodiment of the present invention introduces eBPF technology in the vehicle-side network to ensure that the vehicle-side operating system runs efficiently and safely and supports real-time monitoring of information; it can customize data packet filtering rules and load them into the kernel through the eBPF program for execution, thereby supporting efficient and accurate determination of the data packets to be captured and copying the required data to the user state space, without the need to copy all the data, thus saving user state storage space.

[0041] According to an embodiment of the present invention, an embodiment of a method for processing vehicle-side data is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0042] In this embodiment, a method for processing vehicle-side data is provided, which can be used in a vehicle-side domain controller. Figure 1 is a flow chart of a method for processing vehicle-side data according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0043] Step S101, obtaining the data packet monitoring program and original socket corresponding to the vehicle-side network.

[0044] The packet monitor is a program code written based on the kernel extension mechanism (Extended Berkeley Packet Filter, eBPF), which allows the user-defined code to be safely run in the vehicle-side kernel without modifying the source code. The packet monitor is used to process the captured network data packets to extract the data that needs to be passed to the user space.

[0045] Raw Socket is a type of socket used in network programming, which provides direct access to the underlying network protocol. Through raw sockets, applications can customize the content and format of data packets, including IP headers, TCP headers, UDP headers, etc., thereby providing support for special network functions such as custom protocols, network monitoring, packet filtering, etc. Raw sockets allow applications to read and write unprocessed network packets, including protocol headers and payloads.

[0046] The packet monitoring program is an eBPF program designed by technicians based on the topology of the vehicle-side network, the network protocol used, and the relevant hardware and software components of the vehicle-side to implement packet processing for the vehicle-side network. In the vehicle-side system, raw sockets can be created through the application program interface (API) provided by the vehicle-side operating system; raw sockets can also be obtained and used based on the development documentation of the vehicle-side system.

[0047] Step S102, loading the data packet monitoring program into the kernel state space, and binding the data packet monitoring program to the original socket to obtain a target socket.

[0048] The packet monitoring program is compiled to obtain the corresponding bytecode representation. The bytecode is an instruction set interpreted and executed by the eBPF virtual machine (VM) corresponding to the vehicle-side operating system. It is specific to the eBPF virtual machine and independent of the specific vehicle-side hardware architecture. When the vehicle-side operating system starts the application process, the packet monitoring program is compiled and the bytecode corresponding to the packet monitoring program is loaded into the vehicle-side kernel state space. Specifically, the bytecode can be loaded according to the location of the hook point in the operating system to achieve network performance analysis, security monitoring, etc. for the location of the hook point.

[0049] At the same time, a raw socket is created using the socket programming interface, and the eBPF program is attached to the raw socket. Specifically, a specific system call (such as setsockopt()) or library function can be used to attach the loaded eBPF program to the raw socket to implement the binding of the eBPF program to the raw socket and obtain the corresponding target socket.

[0050] Step S103, monitoring each network data packet passing through the target socket, filtering out the target data packet from each network data packet using a data packet monitoring program, and reading the data in the target data packet into the user state space.

[0051] The target socket is used to monitor the network data packets generated in the vehicle-side network. When the original socket corresponding to the target socket receives the network data packet, the packet monitoring program corresponding to the target socket will be triggered. The packet monitoring program will filter the network data packets received by the original socket to filter out the required target data packets. For example, the DNS data packets are filtered out through the packet monitoring program, and the DNS data packets are used as the target data packets. Then, the target data packets are processed to read the required recorded data from the target data packets and pass the data to the user state space.

[0052] The vehicle-side data processing method provided in this embodiment loads a data packet monitor in the kernel state space and binds the data packet monitor to the original socket, so that all network data packets passing through the original socket will be captured by the data packet monitor, and the data packet monitor can filter and process the various network data packets it obtains to filter out the required target data packets, avoid capturing useless data packets, and save memory resources. Moreover, the data packet monitor can process the target data packets it captures in the kernel state space, without the need to process the target data packets in the user state space during transmission, reducing the context switching between the user state and the kernel state, and saving performance overhead. At the same time, the data packet monitor can accurately filter specific types of target data packets, improving the flexibility of data packet filtering. Therefore, it is conducive to improving the operating stability and operating security of the vehicle-side operating system and ensuring the operating effect of the vehicle-side operating system.

[0053] In this embodiment, a method for processing vehicle-side data is provided, which can be used in a vehicle-side domain controller. Figure 2 is a flow chart of a method for processing vehicle-side data according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0054] Step S201, obtain the data packet monitoring program and original socket corresponding to the vehicle-side network.

[0055] Specifically, the above step S201 includes:

[0056] Step S2011, obtaining the capture strategy of the vehicle-side network data packet.

[0057] The capture strategy is used to characterize the type or purpose of the vehicle-side network data packets to be captured. For example, capturing data packets of a specific protocol or monitoring the data communication between the vehicle-side application and the cloud.

[0058] Specifically, the capture strategy is set by the technician according to actual needs, which can be configured by the corresponding data packet capture tool or edited by the technician according to actual needs. The capture strategy includes information such as the type of data packet to be captured, the network interface of the data packet to be captured, the source address of the data packet, the destination address of the data packet, etc., so as to capture specific data packets from the network data according to the capture strategy.

[0059] Step S2012, determining a data packet monitoring program based on the capture strategy.

[0060] The data packet monitoring program is written by the technicians to implement the capture strategy, that is, there is a one-to-one correspondence between the capture strategy and the data packet monitoring program. Specifically, the data packet monitoring program can be written using C language or other supported programming languages.

[0061] Accordingly, after the data packet monitor is written, the data packet monitor is deployed to the vehicle-side operating system so that the data packet monitor can filter network data packets according to the predefined capture strategy and execute specific data processing logic for the filtered network data packets. When the application process of the vehicle-side operating system is in the startup state, the vehicle-side will obtain the data packet monitor corresponding to the capture strategy, compile the data packet monitor, and load the compiled bytecode file into the vehicle-side kernel to monitor the network data packets generated by the vehicle-side network. Specifically, when the vehicle-side requests to establish a communication connection with the cloud, the vehicle-side will monitor the communication connection between the vehicle-side and the cloud through the data packet monitor.

[0062] Step S2013, obtaining the vehicle-side network interface where the data packet to be monitored is located.

[0063] The data packets to be monitored are network data packets that need to be captured, such as DNS data packets. Different network data packets have different corresponding network interfaces. In order to achieve targeted capture of network data packets, it is necessary to determine the network interface through which the network data packets to be captured pass.

[0064] Specifically, the vehicle-side network interface can be determined by querying the vehicle-side network topology and the corresponding interface identifier; the network configuration tool or management interface deployed on the vehicle can also be used to view the settings and status of the network interface to determine the interface name, IP address, MAC address and other information corresponding to each network interface, thereby determining the vehicle-side network interface where the data packet to be monitored is located; the vehicle-side network interface that the data packet to be captured will pass through can also be determined based on the type of network data packet to be captured. Of course, the vehicle-side network interface where the data packet to be monitored is located can also be obtained by other means. The method for obtaining the vehicle-side network interface is not specifically limited here, and technicians in this field can determine it according to actual needs.

[0065] Step S2014, bind the original socket to the vehicle-side network interface.

[0066] The original socket needs to be bound to a specific vehicle-side network interface in order to monitor and receive data packets transmitted to the vehicle-side network interface. Specifically, after the original socket is created and the vehicle-side network interface is determined, the socket binding function is used to bind the original socket to the interface identifier corresponding to the vehicle-side network interface. In a specific example, the bind() function can be used to bind the original socket to the specified vehicle-side network interface, such as binding the original socket to the specified source port 53, where 53 is the interface identifier of the source port and the source port is the specified vehicle-side network interface.

[0067] After the raw socket is bound to the vehicle-side network interface, the raw socket is used to receive and send network packets. Specifically, the kernel hook point socket_filter is used for the raw socket of type AF_PACKET, so that the raw socket can capture all network packets passing through the specified vehicle-side network interface, including Ethernet frame headers, IP headers, and data of higher-layer protocols.

[0068] Step S202, load the packet monitoring program into the kernel state space, and bind the packet monitoring program to the original socket to obtain the target socket. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0069] Step S203, monitor each network data packet passing through the target socket, filter out the target data packet from each network data packet using the data packet monitoring program, and read the data in the target data packet into the user state space. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0070] The vehicle-side data processing method provided in this embodiment obtains a pre-set network data packet capture strategy to determine the corresponding data packet monitoring program according to the capture strategy, thereby realizing the customization of the data packet monitoring program, facilitating the customization of the data packet monitoring program according to the actual capture strategy required, thereby improving the flexibility of data packet monitoring and realizing the customizability of the data packet monitoring program. Since the data packet monitoring program is loaded in the vehicle-side kernel state space, it can realize real-time monitoring of network data packets while ensuring the efficient and safe operation of the vehicle-side operating system. By binding the original socket to the vehicle-side network interface where the data packet to be monitored is located, it is ensured that all network data packets passing through the vehicle-side network interface can be captured, thereby improving the accuracy of capturing network data packets.

[0071] In this embodiment, a method for processing vehicle-side data is provided, which can be used in a vehicle-side domain controller. Figure 3 is a flow chart of a method for processing vehicle-side data according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0072] Step S301, obtain the data packet monitoring program and original socket corresponding to the vehicle-side network. Figure 2 Step S201 of the illustrated embodiment will not be described in detail here.

[0073] Step S302: Load the packet monitoring program into the kernel space, and bind the packet monitoring program to the original socket to obtain the target socket. Figure 2 Step S202 of the illustrated embodiment will not be described in detail here.

[0074] Step S303, monitoring each network data packet passing through the target socket, filtering out the target data packet from each network data packet using a data packet monitoring program, and reading the data in the target data packet into the user state space.

[0075] Specifically, the above step S303 includes:

[0076] Step S3031, obtaining the target filtering rule corresponding to the data packet monitoring program.

[0077] Target filtering rules are pre-set rules for filtering data packets, such as specific port numbers, protocol types, source addresses or destination addresses, etc. Target filtering rules are deployed in the packet monitoring program. In the process of monitoring network data packets, in order to ensure that the data packets that meet the filtering rules can be monitored, it is necessary to parse the corresponding target filtering rules from the packet monitoring program.

[0078] In an optional implementation, the above step S3031 may include: in response to an update operation on the filtering rule corresponding to the data packet monitoring program, updating the filtering rule corresponding to the data packet monitoring program to obtain an updated target filtering rule.

[0079] Among them, different target filtering rules are used to filter network data packets of different protocols.

[0080] The update operation is an operation in which the technician adjusts the filtering rules according to the packet capture requirements. Since different target filtering rules are adapted to network packets of different protocols, the technician can monitor and capture network packets of different protocols by updating the filtering rules corresponding to the packet monitoring program. Accordingly, the packet monitoring program can respond to the update operation generated by the technician for the filtering rules, and update the filtering rules according to the update operation to generate the latest target filtering rules. In the subsequent monitoring process, the network packets are monitored and captured according to the target filtering rules generated by the update.

[0081] By supporting custom updates of filtering rules, it is convenient to flexibly adjust the filtering rules corresponding to the packet monitoring program according to the packet capture requirements, thereby enabling the monitoring of packets of different protocols, improving the flexibility and scalability of packet monitoring.

[0082] Step S3032, performing port detection on each network data packet to determine the port information of the network data packet.

[0083] The port information is the source port information and destination port information carried by the network data packet. The port information corresponding to the network data packets of different protocols is different. The header of the network data packet contains information about the source port and the destination port. When the network data packet passing through the target socket is monitored, the header of the network data packet is parsed through the packet monitoring program to obtain the source port and destination port of the network data packet.

[0084] Step S3033: If the port information satisfies the target filtering rule corresponding to the data packet monitoring program, the network data packet is determined as a target data packet.

[0085] When a network packet arrives at the target socket, its packet monitor checks the port information of the network packet to determine whether the port information matches the protocol set in the target filtering rule. If a match is successful, the network packet is marked as a target packet and further processed, analyzed or recorded by the packet monitor.

[0086] Step S3034, reading data from the target data packet into the user state space.

[0087] By setting appropriate filtering conditions, the target data packets to be analyzed can be screened out. Then, the data carried in the target data packets are read using the data packet monitoring program, and the read data is transferred from the kernel state space to the user state space.

[0088] It should be noted that the data packet monitoring program is used to monitor specific types of network data packets, such as monitoring DNS data packets. Specifically, if the network data packet is different from the type of data packet to be monitored by the data packet monitoring program, the monitored network data packet will not be processed. Furthermore, if the network data packet is the same as the type of data packet to be monitored by the data packet monitoring program, the port information of the network data packet is detected to see if it meets the target filtering rules. If the port information meets the target filtering rules, the network data packet is processed. If the port information does not meet the target filtering rules, the network data packet is not processed. This achieves filtering and processing of specific network data packets.

[0089] The vehicle-side data processing method provided in this embodiment parses the port information of the network data packet to determine whether the captured network data packet is the target data packet. When it is determined that the target data packet is captured, the target data packet is processed in combination with the data packet monitoring program to read the data monitored by the data packet monitoring program into the user state space, thereby realizing the directional capture of the data packet.

[0090] In some optional implementations, the above step S3034 includes:

[0091] Step a1, obtaining a first data length of a target data packet and a second data length corresponding to a data packet monitoring program.

[0092] Step a2: when the second data length is smaller than the first data length, data interception is performed on the target data packet according to the second data length to obtain target data.

[0093] Step a3, read the target data into the user state space.

[0094] The first data length is the actual data length of the target data packet. Specifically, the first data length can be determined by reading the header information of the target data packet, parsing the data structure of the data packet, or using a specific function. The second data length is the specified data length required by the data packet monitoring program. Specifically, the second data length can be determined by the value returned by the data packet monitoring program.

[0095] The first data length and the second data length are compared to determine whether the first data length and the second data length are the same. If the first data length and the second data length are the same, all the message data in the target data packet are transferred to the user state space; if the first data length is greater than the second data length, it means that the message data in the target data packet needs to be truncated. At this time, the message data in the target data packet is truncated according to the second data length to obtain message data of the second data length, and the message data of the second data length is determined as the target data, and the target data is transferred to the user state space.

[0096] The vehicle-side data processing method provided in this embodiment compares the first data length and the second data length to determine the data that needs to be read into the user state space, thereby achieving effective data transmission and avoiding the transmission of useless data, thereby avoiding exposing sensitive data to the user state space and reducing the possibility of data leakage. At the same time, it greatly reduces the data transmission volume and the processing burden of the user state space, further reduces performance overhead, and improves the operating performance of the vehicle-side operating system.

[0097] In some optional implementations, the above step a3 includes:

[0098] Step a31, detecting whether the data packet monitoring program captures the target data packet in the kernel state space.

[0099] Step a32: if the data packet monitoring program captures the target data packet in the kernel state space, the target data is read from the target data packet and transferred to the user state space.

[0100] Through the kernel hook point socket_filter, packet filtering is performed at the target socket level to finely control the data that can be processed by the user space application. In this kernel hook point, any behavior of the technician's custom filter will not affect the processing of the packet data in the kernel protocol stack, similar to using wireshark to sniff network packets, which will not affect the processing of the packet.

[0101] Monitor the network data packets passing through the target socket, and determine whether the packet monitor has monitored the target data packet based on the return value of the kernel hook point socket_filter. If the packet monitor captures the target data packet in the kernel state space, the corresponding target data is read from the target data packet and passed to the user state space.

[0102] In a specific example, if the return value of the kernel hook point socket_filter is 0, it means that the monitored network data packet is a filter point customized by the technician, and data processing will no longer continue, and the network data packet is not the required target data packet; if the return value of the kernel hook point socket_filter is a positive integer, it means that the network data packet is the target data packet, and the message data of a positive integer length will be passed to the user space through the filter customized by the technician.

[0103] The vehicle-side data processing method provided in this embodiment selects a kernel hook point independent of the kernel protocol stack processing to determine the capture of the target data packet. Any behavior of the kernel hook point will not affect the actual data processing of the target data packet in the kernel protocol stack, thereby achieving imperceptible data processing.

[0104] In some optional implementations, the above method further includes:

[0105] Step b1, analyzing the target data to obtain data analysis results.

[0106] The target data is analyzed using a packet monitoring program to determine the transmission attribute information corresponding to the target data (for example, the four-tuple information consisting of the source IP address, source port number, destination IP address and destination port number), the current system time and the target data extracted from the target data packet.

[0107] Step b2, encapsulating the data analysis results according to a preset data format to obtain encapsulated data, and caching the encapsulated data.

[0108] The preset data format is a pre-set format for data encapsulation, such as the json format. After obtaining the data analysis results, the user state organizes and analyzes the data analysis results, converts the data analysis results according to the preset data format, obtains encapsulated data in the preset data format, and caches the obtained encapsulated data in the user state space.

[0109] In a specific example, if the target data packet is a DNS data packet, the preset data format is a json format, and the data format of the data analysis result corresponding to the DNS data packet is shown in Table 1.

[0110] Table 1 Data format

[0111]

[0112] The data analysis results corresponding to the DNS data packet are encapsulated in json format to obtain the encapsulated data of the DNS data packet, and cached in the user state space. Specifically, the encapsulated data corresponding to the DNS data packet is as follows:

[0113] "DnsData":[160,153,129,128,0,1,0,1,0,0,0,0,10,108,111,103,115,101,114,118,105,99,101,7,1 06,105,100,117,97,112,112,2,99,110,0,0,1,0,1,192,12,0,1,0,1,0,0,0,47,0,4,106,12,251,245],

[0114] "DstIP":"10.155.110.250",

[0115] "DstPort":36876,

[0116] "Idx":15610,

[0117] "SrcIP":"114.114.114.114",

[0118] "SrcPort":53,

[0119] "TimeStamp":1725232978004.

[0120] The vehicle-side data processing method provided in this embodiment encapsulates the data analysis results according to a preset data format, and caches the encapsulated data in the user state space, so that when a network failure occurs, the vehicle-side network failure can be located based on the encapsulated data.

[0121] In some optional implementations, the above step b2 includes:

[0122] Step b21, saving the encapsulated data to the first-level cache space.

[0123] Step b22, reading the encapsulated data from the first-level cache space to the second-level cache space according to a first preset period.

[0124] Step b23, compressing the encapsulated data in the second-level cache space according to the second preset period to obtain compressed data, and storing the compressed data in the third-level cache space.

[0125] The first-level cache space is the memory of the user space; the second-level cache space is the temporary file; the third-level cache space is the log file.

[0126] The first preset period is a pre-set period for reading data from the first-level cache space, such as 300s, 600s, etc.; the second preset period is a pre-set period for data compression, such as 600s, 1800s, 3600s, etc., and the second preset period can be configured through the cloud.

[0127] like Figure 4 As shown, the encapsulated data obtained by sorting according to the preset data format is cached in the first-level cache space, that is, the memory of the user state space. The encapsulated data is read from the first-level cache space according to the first preset period, and a temporary file corresponding to the encapsulated data is generated. Then, for the encapsulated data saved in the temporary file, data compression is performed according to the second preset period, so that the encapsulated data is compressed into a log file for storage, thereby saving data storage space.

[0128] The vehicle-side data processing method provided in this embodiment ensures the high performance of the vehicle-side operating system by adopting a three-level cache to cache the encapsulated data corresponding to the target data packet.

[0129] In some optional implementations, the above method further includes:

[0130] Step c1, check whether the vehicle is powered off.

[0131] Step c2: if the vehicle end is in a power-off state, the preservation of the packaged data from the first-level cache space to the second-level cache space is immediately triggered.

[0132] The running status of the vehicle-side operating system is detected to determine whether the vehicle-side operating system is powered off. If the vehicle-side operating system has been powered off and stopped running, it means that the vehicle is in a powered-off state. At this time, the disk operation of the packaged data is immediately triggered to store the packaged data read from the first-level cache space to the second-level cache space, and the data in the second-level cache space is compressed to generate a corresponding log file for storage.

[0133] The vehicle-side data processing method provided in this embodiment promptly triggers the saving of the encapsulated data corresponding to the target data packet when it detects that the vehicle is in a power-off state, thereby avoiding data loss due to power-off, and providing a stable and accurate data basis for subsequent network fault analysis, performance evaluation, etc.

[0134] In this embodiment, a vehicle-side data monitoring system is also provided. Figure 5 As shown, it includes: a vehicle end 1 and a cloud end 2, and the vehicle end 1 and the cloud end 2 are connected in communication. A domain controller is deployed in the vehicle end 1 to execute the method shown in the above embodiment, and the cloud end 2 is used by technicians to configure monitoring information for the vehicle end 1, including setting the capture strategy of the target data packet, writing the data packet monitoring program, etc. At the same time, the cache information for the vehicle end 1 can also be configured, including setting the cycle of reading the encapsulated data, setting the cache method of the encapsulated data, etc.

[0135] Specifically, technicians can customize eBPF programs according to monitoring information to implement the monitoring logic of network packets, so as to accurately capture, filter and process specific types of network packets (such as DNS packets) according to the filtering logic of the eBPF program, and take corresponding actions according to different conditions, such as logging, triggering alarms or dynamically adjusting system parameters. Moreover, the eBPF program allows technicians to customize the monitoring logic of the target data packet. As a result, the eBPF program directly processes and analyzes the data when the target data packet is captured, without the need for secondary processing after capture, and without the need to access all the data of the entire system or application, thereby reducing security risks.

[0136] When the operating system of the vehicle 1 is started and the user triggers the application process on the vehicle 1, the domain controller deployed in the vehicle 1 will respond to the user's trigger operation and request the cloud 2 to establish a communication channel to build a communication channel between the vehicle 1 and the cloud 2. During the process of building the communication channel between the vehicle 1 and the cloud 2, the packet monitoring program can monitor the target data packet to extract data from the target data packet for security analysis and threat detection, and can also perform performance monitoring and network troubleshooting based on the data extracted from the target data packet.

[0137] The communication connection life cycle monitoring system provided in this embodiment realizes real-time monitoring and capture of data packets by loading the monitoring file into the kernel and using hook points to capture the data packets generated by the vehicle-side and cloud-side during the communication connection process in the kernel, thereby improving the real-time capture of data packets. By parsing the message carried by the data packet to record the communication connection information corresponding to the data packet in the kernel space, there is no need to copy the data of the data packet from the kernel space to the user space, thereby reducing the leakage of potential information, reducing the overhead of data copying, and improving the processing performance of the data packet. The communication connection life cycle is monitored in combination with the communication connection information to determine the communication connection monitoring result, thereby being able to determine the communication connection status between the vehicle-side and the cloud-side through the monitoring result of the communication connection life cycle, so as to identify whether there is a communication anomaly between the vehicle-side and the cloud-side according to the tracked state change of the communication connection state, and being able to accurately attribute the communication anomaly, so as to take protective measures in time to ensure the communication security between the vehicle-side and the cloud-side.

[0138] The embodiment of the present invention also provides a vehicle domain controller, see Figure 6 , Figure 6 is a schematic diagram of the structure of a vehicle domain controller provided by an optional embodiment of the present invention, such as Figure 6 As shown, the vehicle domain controller includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses for communication, and can be installed on a common motherboard or installed in other ways as needed. The processor can process instructions executed in the vehicle domain controller, including instructions stored in or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple vehicle domain controllers can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0139] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0140] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0141] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the vehicle domain controller, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the vehicle domain controller via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0142] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0143] The vehicle domain controller further includes a communication interface 30 for the vehicle domain controller to communicate with other devices or a communication network.

[0144] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0145] A part of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0146] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for processing vehicle-side data, characterized in that: The method comprises: Get the packet monitoring program and raw socket corresponding to the vehicle-side network; Loading the data packet monitoring program into the kernel state space, and binding the data packet monitoring program to the original socket to obtain a target socket; Monitor each network data packet passing through the target socket, filter out the target data packet from each network data packet using the data packet monitoring program, and read the data in the target data packet into the user state space.

2. The method according to claim 1, characterized in that Get the data packet monitoring program corresponding to the vehicle-side network, including: Obtain the capture strategy of vehicle-side network data packets; The packet monitor is determined based on the capture strategy.

3. The method according to claim 1 or 2, characterized in that: Get the original socket corresponding to the vehicle-side network, including: Get the vehicle-side network interface where the data packet to be monitored is located; Bind the original socket to the vehicle-side network interface.

4. The method according to claim 1, characterized in that: The monitoring of each network data packet passing through the target socket, filtering out the target data packet from each network data packet using the data packet monitoring program, and reading the data in the target data packet into the user state space includes: Obtaining target filtering rules corresponding to the data packet monitoring program; Performing port detection on each of the network data packets to determine the port information of the network data packets; If the port information satisfies the target filtering rule corresponding to the data packet monitoring program, determining the network data packet as the target data packet; Read data from the target data packet into the user state space.

5. The method according to claim 4, characterized in that The obtaining of the target filtering rule corresponding to the data packet monitoring program includes: In response to an update operation on the filtering rule corresponding to the data packet monitoring program, the filtering rule corresponding to the data packet monitoring program is updated to obtain the updated target filtering rule; Wherein, different target filtering rules are used to filter the network data packets of different protocols.

6. The method according to claim 4, characterized in that The step of reading data from the target data packet to the user state space includes: Acquire a first data length of the target data packet and a second data length corresponding to the data packet monitoring program; When the second data length is less than the first data length, intercepting the target data packet according to the second data length to obtain target data; The target data is read into the user state space.

7. The method according to claim 6, characterized in that Reading the target data into the user state space includes: Detecting whether the data packet monitoring program captures the target data packet in the kernel state space; If the data packet monitoring program captures the target data packet in the kernel state space, the target data is read from the target data packet and the target data is transferred to the user state space.

8. The method according to claim 1, characterized in that Also includes: Analyze the target data packet to obtain a data analysis result; The data analysis results are packaged according to a preset data format to obtain packaged data, and the packaged data is cached.

9. The method according to claim 8, characterized in that The caching of the encapsulated data includes: Saving the encapsulated data to the first-level cache space; and / or, reading the encapsulated data from the first-level cache space to the second-level cache space according to a first preset period; And / or, compressing the encapsulated data in the second-level cache space according to a second preset period to obtain compressed data, and storing the compressed data in the third-level cache space.

10. The method according to claim 9, characterized in that Also includes: Detecting whether the vehicle end is powered off; If the vehicle end is in a power-off state, the preservation of the packaged data from the first-level cache space to the second-level cache space is immediately triggered.

11. A vehicle-side data monitoring system, characterized in that: include: A vehicle side, used to execute the vehicle side data processing method according to any one of claims 1 to 10; The cloud end is communicatively connected with the vehicle end, and is used to configure monitoring information and cache information of the vehicle end data; wherein the monitoring information includes the capture strategy of network data packets and the data packet monitoring program; the cache information includes the reading cycle and cache method of encapsulated data, and the encapsulated data is generated by encapsulating the target data packet.

12. A vehicle domain controller, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the vehicle-side data processing method according to any one of claims 1 to 10 by executing the computer instructions.

13. A computer program product, characterized in that It includes computer instructions, which are used to enable a computer to execute the vehicle-side data processing method described in any one of claims 1 to 10.

Images