Vehicle network intrusion response method and device, and computer readable storage medium

Abstract

According to the vehicle network intrusion response method and device and the computer readable storage medium provided by the invention, security event data in a vehicle network are analyzed in real time, potential security risks are found in time, and a basis is provided for subsequent processing. The alarm information is generated by analyzing the security event data, so that the network intrusion behavior can be timely responded, and the response speed is improved. Afterwards, deep analysis is carried out on the alarm information, whether the alarm information is a real threat or not is determined, the threat level of the network intrusion behavior is determined in response to the result of whether the alarm information is the real threat or not, and corresponding measures can be taken according to different threat degrees. And executing defense measures in the intrusion response strategy corresponding to the threat level, so that the threat of the network intrusion behavior can be effectively dealt with, and the safety and reliability of the vehicle network are integrally improved.

Description

Technical Field

[0001] The present application relates to the field of automobile network security technology, and in particular to a vehicle network intrusion response method, device and computer-readable storage medium. Background Art

[0002] With the development of intelligent and connected cars, the issue of car network security is becoming increasingly prominent. Hackers can use various means to invade car systems and illegally control vehicles, seriously threatening the lives of drivers and passengers. However, current car safety systems focus more on physical protection and simple software security strategies, and lack effective response and emergency response mechanisms for complex network attacks and intrusion behaviors.

[0003] At present, some automotive security solutions on the market can improve the security of automotive networks to a certain extent, such as firewalls and intrusion detection systems (IDS), but traditional security systems often rely on manual intervention or scheduled scanning and cannot respond to network attacks in real time. In addition, there are problems such as complex security policy configuration and poor flexibility, which makes it difficult to adapt to the changing means of network attacks.

[0004] Therefore, improving the defense capabilities of automotive networks is an urgent issue that needs to be addressed. Summary of the invention

[0005] To overcome the problems existing in the related art, this specification provides a vehicle network intrusion response method, device and computer-readable storage medium.

[0006] According to a first aspect of an embodiment of this specification, a vehicle network intrusion response method is provided, the method comprising:

[0007] Analyze security event data in the vehicle network and generate warning information based on security event data that identifies network intrusion behavior;

[0008] Determining whether the warning information is a real threat;

[0009] In response to whether the warning information is a real threat, determining the threat level of the network intrusion behavior;

[0010] Execute the defense measures in the intrusion response strategy corresponding to the threat level to deal with the threat of the network intrusion behavior.

[0011] According to a vehicle network intrusion response method provided by the present application, the determining whether the warning information is a real threat includes:

[0012] Acquire a threat intelligence library, wherein the threat intelligence library includes at least one known threat information related to vehicle network security; the threat intelligence library includes any one of retrieval behavior records, hacker activity characteristics, and resource information provided by hackers collected from the vehicle network;

[0013] Determine whether the warning information matches known threat information in the threat intelligence library, and determine whether the warning information is a real threat.

[0014] According to a vehicle network intrusion response method provided by the present application, the warning information includes multi-dimensional warning attributes;

[0015] The determining whether the warning information matches known threat information in the threat intelligence library and determining whether the warning information is a real threat includes:

[0016] Filtering the alarm information based on the multi-dimensional alarm attributes of the alarm information according to the filtering conditions associated with the alarm screening attributes related to the vehicle network;

[0017] Determine whether the filtered alarm information hits the known threat information in the threat intelligence library, and determine whether the alarm information is a real threat.

[0018] According to a vehicle network intrusion response method provided by the present application, the warning information includes warning content;

[0019] The determining whether the warning information matches known threat information in the threat intelligence library and determining whether the warning information is a real threat includes:

[0020] Selecting content from the alarm content for analysis based on a unique source of data and / or data integrity;

[0021] The selected content is matched with corresponding content in the known threat information to determine whether the warning information is a real threat.

[0022] According to a vehicle network intrusion response method provided by the present application, the warning information also includes multi-dimensional warning attributes;

[0023] The matching of the selected content with corresponding content in the known threat information to determine whether the warning information is a real threat includes:

[0024] Matching the selected content with corresponding content in the known threat information to determine the matched alarm information;

[0025] According to the filtering condition associated with the alarm screening attribute related to the vehicle network, based on the multi-dimensional alarm attributes of the alarm information, filtering the matched alarm information;

[0026] Determine whether the filtered alert information is a real threat.

[0027] According to a vehicle network intrusion response method provided by the present application, the response to whether the warning information is a real threat result determines the threat level of the network intrusion behavior, including:

[0028] In response to the warning information being a real threat, determining a first threat level of the network intrusion behavior, wherein the first threat level is determined according to a threat level of known threat information matching the warning information in a threat intelligence library; the threat intelligence library includes at least one known threat information related to vehicle network security, and the threat intelligence library includes any one of retrieval behavior records, hacker activity characteristics, and resource information provided by hackers collected from the vehicle network;

[0029] According to a vehicle network intrusion response method provided by the present application, the response to whether the warning information is a real threat result determines the threat level of the network intrusion behavior, including:

[0030] In response to the alarm information being a non-real threat, a second threat level of the network intrusion behavior is determined, where the second threat level is determined according to the threat level of the alarm information.

[0031] According to a vehicle network intrusion response method provided by the present application, when the warning information is a non-real threat, determining the second threat level of the network intrusion behavior includes:

[0032] In response to the warning information being a non-real threat, a second threat level of the network intrusion behavior is determined, wherein the second threat level is determined based on a comprehensive analysis of the warning information and status information of a current intrusion protection system of the vehicle.

[0033] According to a vehicle network intrusion response method provided by the present application, the security event data in the vehicle network is analyzed, and alarm information is generated according to the security event data that identifies the network intrusion behavior, including:

[0034] Through the preset intrusion detection model, the security event data in the vehicle network is analyzed, and alarm information is generated based on the security event data that identifies network intrusion behavior;

[0035] The intrusion detection model is trained by historical security event data and historical analysis results.

[0036] According to a vehicle network intrusion response method provided by the present application, the defense measures in the intrusion response strategy have information on the defense level;

[0037] The executing of the defense measures in the intrusion response strategy corresponding to the threat level, used to deal with the threat of the network intrusion behavior, includes:

[0038] Based on the alarm information, analyzing the attack link of the network intrusion behavior to determine at least one attack process;

[0039] Matching defense measures of corresponding defense levels according to the attack process;

[0040] According to the attack process, the defense measures in the intrusion response strategy corresponding to the threat level are executed in sequence to deal with the threat of the network intrusion behavior.

[0041] According to a vehicle network intrusion response method provided by the present application, after executing the defense measures in the intrusion response strategy corresponding to the threat level to cope with the threat of the network intrusion behavior, the method further includes:

[0042] Obtaining defense result data after executing the defense measures;

[0043] The defense result data is evaluated according to preset evaluation indicators, a feedback report including the evaluation results is generated, and the feedback report is output.

[0044] The present application also provides a vehicle network intrusion response device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the vehicle network intrusion response method described above is implemented.

[0045] The present application also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the vehicle network intrusion response method as described in any one of the above is implemented.

[0046] The vehicle network intrusion response method, device and computer-readable storage medium in the embodiments of this specification are compared with the insufficient defense capabilities of the current vehicle network. Real-time analysis of security event data in the vehicle network is carried out to timely discover potential security risks and provide a basis for subsequent processing. Warning information is generated by analyzing security event data so that timely response can be made when network intrusion occurs to improve the response speed. Thereafter, the warning information is deeply analyzed to determine whether it is a real threat, which can avoid unnecessary waste of resources caused by false alarms and ensure accurate response to real threats. Then, the threat level of the network intrusion behavior is determined in response to the result of whether the warning information is a real threat, so that the assessment of security events is more accurate and corresponding measures can be taken according to different threat levels. The defense measures in the intrusion response strategy corresponding to the threat level can effectively respond to the threat of network intrusion behavior and minimize the damage of the intrusion behavior to the vehicle network and the impact on the safety of vehicles and passengers. Thereby improving the security and reliability of the vehicle network as a whole, providing a strong guarantee for the safe driving of intelligent networked vehicles.

[0047] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and, together with the description, serve to explain the principles of the specification.

[0049] Figure 1 is a flow chart of a vehicle network intrusion response method according to an exemplary embodiment of the present specification;

[0050] Figure 2 is a schematic diagram of the architecture of a vehicle intrusion response and emergency handling system according to an exemplary embodiment of the present specification;

[0051] Figure 3 is a schematic diagram of a vehicle network intrusion response device according to an exemplary embodiment of the present specification;

[0052] Figure 4 It is a schematic block diagram of a vehicle network intrusion response device shown in this specification according to an exemplary embodiment. DETAILED DESCRIPTION

[0053] Here, the technical solutions in the embodiments (or "implementations") of the present application will be described clearly and completely in conjunction with the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements.

[0054] If there are terms involving directional indications or positional relationships in the embodiments of the present application (such as up, down, left, right, front, back, inside, outside, top, bottom, center, vertical, horizontal, longitudinal, transverse, length, width, counterclockwise, clockwise, axial, radial, circumferential, etc.), such terms are only used to explain the relative positional relationship, movement, etc. between the components under a certain specific posture (as shown in the accompanying drawings); if the specific posture changes, the directional indication or positional relationship will also change accordingly. In addition, the terms "first", "second", etc. involved in the embodiments of the present application are only used for the purpose of convenience of description and cannot be understood as indicating or implying relative importance.

[0055] The present application provides a vehicle network intrusion response method, device and computer readable storage medium. The present application is described in detail below in conjunction with the accompanying drawings. The features of the following embodiments and implementations can be combined with each other if there is no conflict.

[0056] With the development of intelligent and connected cars, the issue of car network security has become increasingly prominent. Hackers can use various means to invade car systems and illegally control vehicles, seriously threatening the lives of drivers and passengers. Existing car safety systems focus on physical protection and simple software security strategies, and lack effective response and emergency response mechanisms for complex network attacks and intrusions.

[0057] There are some automotive security solutions on the market, such as firewalls and intrusion detection systems (IDS). Although they can improve the security of automotive networks to a certain extent, they generally have the following problems:

[0058] Slow response: Traditional security systems often rely on manual intervention or scheduled scanning and cannot respond to cyber attacks in real time.

[0059] Low level of automation: There is a lack of efficient automated response mechanisms, which makes it impossible to quickly block attacks and restore normal system operations.

[0060] Single strategy: The security policy configuration is complex and inflexible, making it difficult to adapt to changing network attack methods.

[0061] Poor linkage: There is a lack of effective linkage between security devices, and a unified defense system cannot be formed.

[0062] In order to solve the above technical problems, this specification provides a vehicle network intrusion response method.

[0063] Figure 1 1 is a flow chart of a vehicle network intrusion response method provided by an embodiment of this specification, comprising the following steps:

[0064] Step 110: Analyze the security event data in the vehicle network, and generate warning information based on the security event data that identifies the network intrusion behavior;

[0065] Step 120: Determine whether the warning information is a real threat;

[0066] Step 130: In response to whether the warning information is a real threat, determine the threat level of the network intrusion behavior;

[0067] Step 140: Execute the defense measures in the intrusion response strategy corresponding to the threat level to deal with the threat of the network intrusion behavior.

[0068] This embodiment aims to monitor network intrusion behavior in real time and automatically trigger the preset emergency response mechanism through the above-mentioned intrusion response and emergency handling process for the vehicle network. In emergency response, multiple intrusion response strategy configurations are set, and different intrusion response strategies are used according to different threat levels to improve the flexibility of defense, quickly block attacks and restore the normal operation of the vehicle network system. At the same time, it supports the linkage of multiple security devices to form a comprehensive security protection system.

[0069] This embodiment solves the problems existing in the existing automobile security solutions through the above-mentioned method, thereby achieving more efficient and accurate automobile network security protection.

[0070] As an example, the vehicle network intrusion response method can be applied to a vehicle intrusion response and emergency handling system (hereinafter referred to as the system). Figure 2 As shown, the system is based on a modular design and includes at least one of an event monitoring module, an alarm investigation module, a scenario management module, a linkage processing module, and a notification management module. The modules communicate with each other through standard interfaces to form a complete intrusion response and emergency handling process.

[0071] The event monitoring module is responsible for real-time collection of security event data in the vehicle network, including but not limited to alarms from the vehicle intrusion monitoring system, firewall logs, abnormal behaviors of the vehicle control unit (ECU), etc. The event monitoring module is integrated with an efficient intrusion detection engine that can analyze network traffic in real time and accurately identify network intrusion behaviors.

[0072] In some embodiments, the event monitoring module performs the method of step 110, using data processing technology to ensure rapid and accurate screening and preliminary analysis of massive security events. It can also detect network intrusion behavior in real time and automatically trigger emergency response mechanisms. The specific embodiments of this process will be described in detail in subsequent chapters.

[0073] The alarm investigation module automatically starts the corresponding investigation process after receiving the alarm information transmitted by the event monitoring module. The module uses the built-in threat intelligence library to conduct in-depth analysis of the alarm information, determine whether it is a real security threat, and identify key information such as the type, source, and target of the threat.

[0074] In some embodiments, the alarm investigation module performs the method of step 120 to step 130 to improve the quality of alarms and reduce false positives and false negatives. The specific embodiments of this process will be described in detail in subsequent chapters.

[0075] The script management module supports user-defined plans and multiple trigger mechanisms to meet security requirements in different scenarios. Specifically, the script management module is responsible for the creation, editing, storage and query of scripts. Users can flexibly configure scripts according to actual needs to implement personalized intrusion response strategies. Among them, the script defines a series of automated response processes for specific types of security threats. The script is the key to achieving automated response, which means that it plays a core role in the entire system. Through the script, the system can automatically handle various security incidents according to predetermined processes, support automated response and plan arrangement, without the need for human intervention, and greatly improve response speed and efficiency.

[0076] In some embodiments, users can create and edit scripts in a graphical user interface (GUI) through the script management module. The graphical user interface (GUI) allows users to create and edit scripts more intuitively and conveniently, reducing the difficulty of operation and improving user experience. As an example, the system can adopt the SOAR (Security Orchestration, Automation and Response) architecture to streamline and automate the monitoring, investigation, analysis and disposal of security incidents.

[0077] Specifically, each script consists of a series of components, which represent specific processing steps or decision points in the processing flow. The components are connected to each other through logical relationships (such as sequential execution, conditional branches, etc.), and together constitute a complete processing flow, ensuring that the system can respond to various security situations in an orderly manner.

[0078] Among them, the script management module supports multiple types of components, including but not limited to logical branch components, IP blocking components, access control components, etc.

[0079] Logical branching component: used to select branches according to different conditions in the processing flow. For example, when different types of threats are detected, different processing paths can be selected according to the severity of the threat. Users can set branching conditions, such as specific alarm information characteristics or threat levels, as well as branching events, which are specific operations performed when the conditions are met.

[0080] IP blocking component: used to block specific IP addresses to prevent malicious attacks from that address. Users need to specify parameters such as the blocked IP address, port, and effective time. The effective time can be set according to actual conditions so that the blockage can be automatically lifted after a certain period of time.

[0081] Access control component: used to control access rights to system resources. You can set access rights for different users or roles to restrict unauthorized access. Parameter settings may include user groups, resource types, permission levels, etc.

[0082] In other examples, when the alarm investigation module in the system is built into the script management module as a threat intelligence analysis component, or when the alarm investigation module is not set in the system, the components in the script management module also include a threat intelligence analysis component. The threat intelligence analysis component is responsible for analyzing and processing threat intelligence. It can compare the received alarm information with the data in the threat intelligence library to determine the type and severity of the threat. The parameter settings of this component may include selecting the content of the analysis (such as IP address, domain name, etc.), setting filtering conditions, etc.

[0083] In the script management module, each of the above components has specific functions and parameter setting options to meet the processing requirements in different scenarios. When creating or editing a script, the user needs to set parameters for each component. Parameter setting is an important part of creating and editing a script. These parameters define the specific behavior and trigger conditions of each component.

[0084] As an example, in the logical branch component, users need to set branch conditions and branch events. It is understandable that the setting of branch conditions needs to be analyzed according to the actual situation to ensure that branch selection can be made accurately according to different situations. Branch events need to clarify specific processing operations so that they can be correctly executed when the conditions are met. In the IP blocking component, users need to specify the blocked IP address, port, and effective time, etc. It is understandable that the blocked IP address and port need to be accurately specified to ensure that malicious attacks can be effectively blocked. The setting of the effective time should take into account the duration and impact of the attack to avoid unnecessary impact on the system caused by too long or too short blocking time. In the access control component, the settings of user groups, resource types, and permission levels need to be reasonably allocated according to the security requirements of the system and the roles of users to ensure the security and availability of the system.

[0085] In the script management module, users can design the script processing flow on the GUI by dragging and dropping components. This method is intuitive and convenient, and users can easily build complex processing flows. The intuitive connection lines and conditional judgment symbols provided by the system help users clearly express the logical relationship between components, making the processing flow easier to understand and maintain. After completing the design, users can save the script and perform test verification to ensure the correctness and effectiveness of the script. Test verification can simulate various security incidents to check whether the script can be processed according to the expected process, and timely discover and fix potential problems.

[0086] It should be noted that there is a correlation between the intrusion response strategy set by the script and the defense measures of the intrusion response. When a network intrusion occurs, the defense measures of the intrusion response strategy are executed to deal with the threat of network intrusion. This part will be explained in detail later.

[0087] In this embodiment, the script design of the system takes full account of flexibility and scalability. Users can customize the script content according to actual needs, including adding or deleting components, adjusting component parameters, and setting trigger conditions. In addition, the system also supports multiple types of script templates, such as emergency response scripts for specific threats, daily inspection scripts, etc., and users can select or modify them according to actual conditions. Among them, the defense level of the intrusion response strategy of the emergency response script for specific threats is higher than the defense level of the intrusion response strategy of the daily inspection script. The defense measures corresponding to different defense levels are used to handle network intrusion behaviors in different scenarios, effectively avoiding the impact of the threat and defense behavior of network intrusion behaviors on business operations. For example, the intrusion response strategy of the daily inspection script can be to record the network intrusion behavior without affecting the driving of the vehicle, and then perform system upgrades to improve the security protection level of the vehicle network. The emergency response script for specific threats can be to shut down the network function of the vehicle and temporarily shut down all network ports to deal with the threat when the degree of attack seriously affects the driving of the vehicle. It can be understood that the intrusion response strategies of these two scripts are different and are selected according to actual needs.

[0088] Furthermore, as cyber threats continue to evolve and technology continues to advance, the system also supports continuous updating and optimization of the script. Users can adjust and improve the script based on the latest threat intelligence and best practices to ensure that the system's protection and emergency response capabilities are always maintained at a high level.

[0089] Linkage Disposal Module: The linkage disposal module plays a key role in the entire security protection system. When the alarm information is confirmed to be a real threat after analysis, the module is triggered and started. The linkage disposal module will automatically execute the corresponding disposal measures according to the pre-defined intrusion response strategies in the script. These strategies specify in detail the specific disposal measures to be taken in different situations. This design ensures that the system can respond quickly and automatically when facing network security threats, greatly improving the efficiency and accuracy of responding to threats. In addition, it supports linkage with security equipment to form a multi-level defense system and enhance the linkage of the system.

[0090] In some embodiments, these measures include but are not limited to blocking the attack source, isolating the infected device, recording detailed logs for subsequent analysis, etc. It aims to quickly block the attack source, isolate the infected system or device, and initiate the emergency response process, thereby minimizing the impact of the threat on business operations.

[0091] In other embodiments, the linkage handling module achieves efficient network security protection through close integration with vehicle ECU, firewall, vehicle's current IDS system (Intrusion Detection System) and other devices. This integration enables the linkage handling module to respond to various network security threats quickly and effectively.

[0092] Notification management module: During the entire intrusion response and emergency handling process, the notification management module is responsible for notifying relevant personnel of key information through emails, text messages, corporate WeChat group messages, etc., to ensure that relevant personnel can promptly understand the occurrence and progress of security incidents. When facing network security threats, rapid notifications can prompt relevant personnel to make decisions and take actions quickly, thereby effectively reducing the impact of security incidents on systems and businesses.

[0093] Notifications of this information include but are not limited to alarm notifications, disposal result notifications, system status change notifications, etc.

[0094] The automobile intrusion response and emergency handling system provided by the present application may have the following beneficial effects:

[0095] First, the event monitoring module integrates an advanced intrusion detection engine to analyze network traffic in real time and accurately identify intrusion behaviors. Once an intrusion is detected, the emergency response plan is automatically triggered, including blocking the attack source, isolating infected devices, and launching security audits, etc., to quickly block the attack and reduce losses. This solves the problem that the existing automobile safety system cannot respond to intrusions in a timely manner and cannot automatically handle them, and improves the safety and reliability of the system.

[0096] Secondly, the script management module supports user-defined plans, which can be arranged according to actual needs, and provides a visual arrangement interface to reduce the difficulty of operation. At the same time, it supports multiple trigger mechanisms to ensure that the plan responds to intrusion behaviors accurately and promptly. This invention enables the system to adapt to different security scenarios and user needs, and improves the flexibility and scalability of the system.

[0097] Thirdly, the linkage processing module supports linkage with multiple security devices to achieve centralized management and unified execution of security policies. When an intrusion is detected, it automatically sends instructions to relevant security devices to implement control or blocking operations, forming a multi-level defense system, and also supports withdrawal operations to deal with false alarms or misoperations. This invention enhances the system's defense capabilities and improves the effect of security protection.

[0098] Fourthly, the alarm investigation module filters, merges and analyzes alarm information through technical means, removes errors and duplicate alarms and improves the quality of alarms. It supports the combination of man and machine to complete the alarm information investigation. Users can supplement the investigation information to convert low-quality alarms into high-quality valuable alarms. It also provides alarm overview, tracing, statistics and other functions. This invention helps users better understand the alarm situation, reduce false alarms and missed alarms, and improve the security and manageability of the system.

[0099] like Figure 1 As shown, based on the above-mentioned automobile intrusion response and emergency processing system, the steps of the above-mentioned vehicle network intrusion response method are specifically introduced as follows:

[0100] In step 110, security event data in the vehicle network is analyzed, and alarm information is generated based on the security event data that identifies network intrusion behavior.

[0101] The security event data described in this article refers to various information or records obtained through daily monitoring of the vehicle network environment, including but not limited to the alarm data of the intrusion detection system, firewall logs, abnormal behavior of the vehicle control unit (ECU), etc. These data reflect the abnormal situations that may exist in the vehicle network, but do not mean that these situations will necessarily constitute a security threat.

[0102] For example, an intrusion detection system may issue an alarm due to network fluctuations or some normal network activities, but this does not necessarily mean that a real attack has occurred. Similarly, some abnormal behaviors of the ECU may be caused by temporary system failures or environmental factors, not necessarily caused by security attacks. Therefore, it is necessary to analyze security event data to determine whether these events are threatening. This process includes analyzing security event data to determine network intrusion behavior.

[0103] The vehicle network is a network formed by connecting the various electronic control units, sensors, actuators, and in-vehicle infotainment systems in the vehicle through wired and wireless communication, and interacting with external devices and networks through technologies such as Bluetooth, Wi-Fi, and mobile networks. It is not only responsible for achieving efficient data transmission and collaborative work between various systems within the vehicle to ensure the normal driving of the vehicle and the stable operation of various functions, but also faces various attack threats from external hackers.

[0104] The security event data is comprehensively analyzed and processed through the algorithm in the intrusion detection engine to detect potential network intrusion behaviors and generate corresponding alarm information. The algorithm used can be any deep algorithm, which is trained by calculating and processing a large amount of data obtained in historical network usage scenarios, so that it can identify network intrusion behaviors in different scenarios, thereby improving the accuracy of data recognition and solving the problem of false alarms that may be caused by the current recognition method based on preset recognition rules.

[0105] In some embodiments, step 110 may specifically include: in step 111, analyzing security event data in the vehicle network through a preset intrusion detection model, and generating alarm information based on the security event data that identifies network intrusion behavior; wherein the intrusion detection model is trained by historical security event data and historical analysis results.

[0106] The algorithm in the intrusion detection engine uses a deep learning algorithm to analyze the input security event data, output a numerical value related to the security level class, compare the numerical value with the set alarm threshold, and generate alarm information for the security event data corresponding to the numerical value exceeding the alarm threshold for subsequent response to the intrusion.

[0107] In step 120, it is determined whether the warning information is a real threat.

[0108] False alarms are common in automotive network security monitoring. False alarms may be caused by excessively high sensitivity settings of security devices, complexity of network environment, system failures, etc. For example, an intrusion detection system may misjudge some normal network traffic as attack behavior and issue an alarm. A firewall may also record unnecessary log information due to some temporary network configuration changes.

[0109] In order to improve the efficiency and accuracy of security incident handling, further analysis and investigation of alarm information is required to determine whether these events pose a real threat, improve the accuracy of alarm information, reduce false positives and missed positives, and enable security personnel or systems to quickly and accurately identify and handle important security incidents.

[0110] In some embodiments, the above process can be implemented by an alarm investigation module in the system. When an alarm message is generated, the alarm investigation module is started, and the threat intelligence collision analysis therein begins to play a role. This process is intended to determine whether the alarm message represents a real security threat.

[0111] As an example, step 120 may specifically include: in step 121, obtaining a threat intelligence library, wherein the threat intelligence library includes at least one known threat information related to vehicle network security; in step 122, determining whether the warning information hits the known threat information in the threat intelligence library, and determining whether the warning information is a real threat.

[0112] A threat intelligence library is built into the system. The threat intelligence library is a collection of static data related to network security. It covers any or at least one of the following contents collected from the vehicle network, such as retrieval behavior records, hacker activity characteristics, and resource information provided by hackers, forming a large amount of known threat information. Known threat information can include but is not limited to malicious IP addresses, domain names, virus samples, etc.

[0113] In terms of data sources, for network search data, specific search keywords, search source IP addresses and other information are recorded to form a queryable search behavior archive. For hacker resource data, including known hacker attack tool features, common attack mode descriptions, malware sample features, etc., they are stored in the library in the form of detailed documents and feature codes. For hacker resource data, such as security vulnerability discovery reports and defense strategy recommendations, they are also saved in a standardized format to generate a threat intelligence library.

[0114] Specifically, the collision analysis process is to compare the alarm information with the data in the built-in threat intelligence library one by one, determine whether the alarm information hits the known threat information in the threat intelligence library, and determine whether the alarm is a real threat based on the comparison results. The comparison results can be, but are not limited to, the alarm information is completely consistent with a known threat information, the alarm information has a high degree of similarity or matching with the data in the threat intelligence library, etc.

[0115] It can be understood that if the alarm information hits a record or known threat information in the threat intelligence library, the alarm information is determined to be a real threat. In other examples, when the alarm information is determined to be a real threat, the collision analysis can also provide key information about the type, source, target, etc. of the threat. For example, if the alarm information matches a malicious IP address in the threat intelligence library, then it can be determined that the source of the threat is the IP address, and the type of threat can be determined based on the information in the threat intelligence library, such as malware attack, network scanning, etc.

[0116] Anyway, if the alarm information does not hit a record or known threat information in the threat intelligence library or there is no obvious match, it is determined that the alarm information is not a real threat.

[0117] It should be noted that since the threat information in the threat intelligence library is information that has already occurred, it is close to reality, more accurate and comprehensive. Therefore, the threat intelligence library can be used to further verify the alarm information and determine whether the network intrusion behavior corresponding to the alarm information is a real threat. Furthermore, the threat level of the network intrusion behavior is determined so that the intrusion response strategy corresponding to the threat level can be implemented in a targeted manner. It can be understood that both real threats and non-real threats indicate that the network intrusion behavior corresponding to the alarm information is threatening. Real threats refer to threats that are highly similar to the threat intelligence library, conform to the trend of network attacks, and may have a significant impact on vehicle safety. Non-real threats are threats that do not exist in the threat intelligence library.

[0118] In some embodiments, the analysis results are displayed in the response record based on the comparison results, informing the user whether the alarm information hits the threat intelligence library and the specific threat information or a prompt of a miss.

[0119] When analyzing alarm information, in order to improve the efficiency and accuracy of security incident processing, it is necessary to screen the collected security incident data and filter out false alarms or untrue situations. This can avoid unnecessary waste of resources and misoperation, and also reduce interference to users. The screening method can be, but is not limited to, screening alarm information according to the analysis content and filtering conditions set by the user to determine which alarm information needs to be compared more deeply, or to determine which alarm information is ultimately a real threat.

[0120] As an example, the alarm information includes multi-dimensional alarm attributes; the step 122 may specifically include: in step a1, according to the filtering conditions associated with the alarm screening attributes related to the vehicle network, based on the multi-dimensional alarm attributes of the alarm information, filtering the alarm information; in step a2, determining whether the filtered alarm information hits the known threat information in the threat intelligence library, and determining whether the alarm information is a real threat.

[0121] The alarm information includes multi-dimensional alarm attributes, which may include but are not limited to multiple dimensions such as time range, threat level, and source area.

[0122] The filtering condition includes a filtering condition associated with at least one of the alarm attributes, and performs filtering processing on the alarm information. It includes at least one of the following: filtering the alarm information by the condition of the set time range. It is understandable that the user sets a specific time range, such as only focusing on threat intelligence within the last week. This can reduce unnecessary analysis and improve efficiency. If the time when the alarm information occurs is not within the set time range, the system will not identify it as a real threat for further analysis. In other words, the interference of other time periods is excluded by the time range filtering condition.

[0123] Filter the alarm information by setting the threat level range. It is understood that the user sets the threat level filtering conditions according to actual needs, such as only focusing on alarm information with a high threat level. If the threat level corresponding to the alarm information is lower than the set level, the system will not identify it as a real threat. It should be noted that the threat level corresponding to the alarm information will be explained in detail in subsequent chapters.

[0124] By setting the filter conditions of the source area, you can filter the alarm information. It is understandable that you focus on threats from a specific area. For example, if you know that network attacks in a certain area are frequent, you can set the source area to that area and conduct a more rigorous analysis of the alarm information from that area.

[0125] Finally, the qualified alarm information is compared with the data in the built-in threat intelligence library one by one to determine whether the alarm information is a real threat.

[0126] In this embodiment, in order to improve the accuracy and efficiency of the analysis, the user can set filtering conditions associated with the alarm screening attributes related to the vehicle network. Only when the alarm information meets all the set filtering conditions will it be identified as a real threat.

[0127] In another example, the alarm information includes alarm content; the step 122 may specifically include: in step b1, according to the unique source of data and / or data integrity, selecting content in the alarm content for analysis; in step b2, matching the selected content with the corresponding content in the known threat information to determine whether the alarm information is a real threat.

[0128] The alarm information includes alarm content, which may include but is not limited to the IP address, domain name, content corresponding to the file hash value, etc. of the event.

[0129] Users can select analysis content as needed, including but not limited to selecting content for collision analysis based on unique data sources (such as IP addresses, domain names, etc.) and / or data integrity (such as file hash values, etc.). The system will compare the selected content one by one to determine whether it exists in the threat intelligence library.

[0130] It can be understood that for IP address content, if you choose to analyze the IP address in the alarm information, the system will compare the source IP address and the destination IP address in the alarm information with the malicious IP addresses in the threat intelligence library. For example, if the alarm information shows that the network connection from a specific IP is abnormal, and this IP is marked as a malicious IP in the threat intelligence library, then there may be a security threat. Therefore, IP address analysis is used to determine whether there is a known malicious IP attacking the car network. For domain name content, for the domain name part in the alarm information, the system will check whether it matches the malicious domain name in the threat intelligence library. For example, if a communication in the car network involves a suspicious domain name, and this domain name is listed as related to malicious activities in the threat intelligence library, further investigation is required. Therefore, domain name analysis helps to identify whether there is an attack through a malicious domain name. For file hash value content, when it comes to file-related alarm information, the security of the file can be determined by analyzing the file hash value. The system compares the file hash value in the alarm information with the known malicious file hash value in the threat intelligence library. If the match is successful, it means that the file may be malware or a tampered file, posing a security threat to the car system.

[0131] In this embodiment, determining which specific elements are extracted from the warning information for comparison is to determine the object of collision analysis from a technical level and to determine whether the warning information is a real threat.

[0132] It is worth noting that the above-mentioned screening methods for screening alarm information by analyzing content and filtering conditions can be used alone or in combination. When used in combination, the order of using the two screening methods can be adaptively adjusted according to actual needs. The following is an example of the screening method of filtering after content analysis. Other embodiments are basically the same and will not be repeated here.

[0133] In other examples, the alarm information also includes multi-dimensional alarm attributes; the step b2 may specifically include: in step b21, matching the selected content with the corresponding content in the known threat information to determine the alarm information that passes the match; in step b22, filtering the alarm information that passes the match based on the multi-dimensional alarm attributes of the alarm information according to the filtering conditions associated with the alarm screening attributes related to the vehicle network; and in step b23, determining whether the filtered alarm information is a real threat.

[0134] In this embodiment, after selecting the content for analysis in the alarm content according to the unique source of data and / or data integrity, the selected content is matched with the corresponding content in the threat information to determine the alarm information that passes the match. Afterwards, the alarm information that passes the content analysis is filtered to select the alarm information that meets the filtering conditions. Only when the alarm information meets all the set filtering conditions will it be identified as a real threat.

[0135] After the above collision analysis of the alarm information based on the threat intelligence library is completed, the system will display the analysis results in the response record, informing the user whether the alarm information hits the threat intelligence library and the specific threat information or a miss prompt. If the alarm information hits a record in the threat intelligence library, detailed threat information (such as threat level, reputation value, etc.) will be displayed; if it does not hit, a miss prompt will be displayed.

[0136] In step 130, in response to whether the alarm information is a real threat result, the threat level of the network intrusion behavior is determined.

[0137] When dealing with network intrusions, if the same measures are taken for all intrusions, resources may be wasted, or strong measures may not be taken in a timely and effective manner when facing serious threats. Therefore, it is necessary to determine the threat level of network intrusions. Different levels of response and defense measures are required for different threat levels, so that the measures to deal with threats are more precise and avoid overreaction or underreaction.

[0138] In some embodiments, step 130 may specifically include: in step 131, in response to the alarm information being a real threat, determining a first threat level of the network intrusion behavior, wherein the first threat level is determined according to a threat level of known threat information matching the alarm information in a threat intelligence library;

[0139] The threat intelligence library includes at least one known threat information related to vehicle network security, and the threat intelligence library includes any content of retrieval behavior records, hacker activity characteristics, and resource information provided by hackers collected from the vehicle network.

[0140] Since the known threat information in the threat intelligence library is information that has already occurred, it can accurately reflect the threat level of network intrusion behavior to the vehicle network. In addition, since the warning information is generated by security event data, if the security event data is incomplete or the accuracy is low, it may lead to the problem of low accuracy of the threat level determined based on the warning information. Therefore, when the warning information matches the known threat information, the threat level corresponding to the known threat information is used as the threat level of the network intrusion behavior corresponding to the current warning information.

[0141] In some other embodiments, the step 130 may specifically further include: in step 132, in response to the alarm information being a non-real threat, determining a second threat level of the network intrusion behavior, the second threat level being determined according to the threat level of the alarm information.

[0142] When generating alert information based on security event data, a rough threat level assessment will be performed based on some preliminary features of the alert information. For example, if the alert information shows that it comes from an unknown IP address and the behavior pattern of the IP address is suspicious (such as frequent attempts to connect to multiple ports), the system can initially mark it as a lower threat level for further analysis.

[0143] If the collision analysis determines that the warning information is a real threat, the threat level of the warning information is determined based on the threat level of the known threat information that matches the warning information. If the collision analysis determines that the warning information is not a real threat, which means that there is no threat level of known threat information to refer to, the threat level is determined based on the content of the warning information.

[0144] In other examples, step 130 may specifically include: in step 133, in response to the alarm information being a non-real threat, determining a second threat level of the network intrusion behavior, wherein the second threat level is determined based on a comprehensive analysis of the alarm information and status information of the vehicle's current intrusion protection system.

[0145] If the collision analysis determines that the warning information is not a real threat, in order to improve the accuracy of the judgment of the threat level of the warning information, the threat level of the warning information is comprehensively determined based on the current state information of the intrusion protection system of the vehicle. The state information may be, but is not limited to, the running state, the updating state, etc.

[0146] For example, if the intrusion protection system is in normal operation and can effectively detect and block potential threats, then even if an alarm message that is not a real threat appears, its second threat level may be relatively low. However, if the protection system has vulnerabilities, performance degradation, or partial functional failure, then even an alarm message that seems to be a non-real threat may have a higher potential risk, thereby increasing the second threat level.

[0147] For another example, consider the interaction between the intrusion protection system and other vehicle systems. If the communication between the intrusion protection system and other key systems is abnormal, or the status changes of other systems may affect the performance of the intrusion protection system, then the potential risk of the warning information of non-real threats also needs to be re-evaluated, and the second threat level is adjusted accordingly.

[0148] In other embodiments, the threat level of network intrusion behavior can also be determined in combination with other factors. Other factors may be, but are not limited to, alarm frequency, system response, and association with other security devices. For example, a scenario in which the threat level is determined in combination with the alarm frequency. If the same or similar alarm information appears multiple times in a short period of time, it means that there may be a persistent attack and the threat level may be high. If multiple attack alarms from the same IP address are received continuously, the threat represented by this IP address may be more serious. At this time, the threat level determined only by the alarm information needs to be increased.

[0149] For another example, if other security devices (such as firewalls, intrusion detection systems, etc.) also detect abnormal conditions related to the alarm, the degree of the threat can be further determined. For example, if the firewall detects a large number of connection requests from a specific IP address, and the intrusion detection system also issues an alarm for the IP address, then the threat represented by this IP address may be more serious. The specific implementation method of determining the threat level in combination with other factors is basically the same and will not be repeated here.

[0150] Through the above methods, the threat level can be accurately determined and the corresponding response strategy and defense measures can be implemented to minimize the security threat of network intrusion to vehicles and passengers. Timely and effective response measures can prevent further development of attacks, protect the key systems and functions of the vehicle, and ensure the safe driving of the vehicle and the safety of passengers.

[0151] In order to improve the quality of alarms, this embodiment uses technical means such as alarm aggregation and alarm analysis to filter, merge and analyze alarm information, remove false alarms and duplicate alarms, and improve the quality of alarms. At the same time, the system supports the human-machine combination to complete the alarm information investigation. Users can supplement the investigation information as needed to turn low-quality alarms into high-quality and valuable alarms. In addition, the system also provides alarm overview (provides a comprehensive alarm view so that users can quickly understand the alarm situation in the current system. The overview interface can display the number, type, severity and other information of alarms, as well as the distribution of alarms classified by time, region, equipment and other dimensions.), alarm tracing (allows users to trace specific alarms and view the historical process and related event chains of their generation. Through alarm tracing, users can understand the origin, development process and correlation of alarms with other alarms.), alarm statistics (perform statistical analysis on alarm information and generate various reports and charts. The statistical function can provide information about the distribution, trend, processing status and other information of alarms to help users understand the security status and change trend of the system.) and other functions to help users fully understand the alarm situation.

[0152] In step 140, the defense measures in the intrusion response strategy corresponding to the threat level are executed to deal with the threat of the network intrusion behavior.

[0153] After confirming that the alarm information is a real threat, the linkage disposal module will automatically execute corresponding disposal measures for different threats based on the intrusion response strategy defined in the script.

[0154] It is understandable that in the Internet of Vehicles environment, different response strategies will be adopted for cyber attacks according to their threat level. If the threat level of the cyber attack is determined to be low, that is, it has not caused any actual impact and has not damaged the normal functions of the vehicle, although it can be determined that the danger is attacking the vehicle, the situation is not urgent and the existing protection technology is not affected, the danger can be ignored first. If it is later discovered that the attack has an impact on the existing protection technology, a relatively slow process will be used to transform and upgrade the entire system, and then the entire system will be updated after the upgrade. If a serious attack occurs, the automated processing process will use emergency measures to first repair the danger to the current vehicle and solve the problem, and then perform large-scale repairs on other vehicles that have suffered the same attack. Users can create and edit intrusion response strategies in the script management module according to actual needs.

[0155] In summary, when the system responds to network intrusions, different intrusion response strategies are implemented according to different threat levels. When the threat level is low, a more conservative approach is adopted to avoid overreaction and waste of resources; when the threat level is high, strong emergency measures are taken quickly to ensure vehicle safety and normal operation. This association between response strategy and threat level helps to efficiently utilize resources, accurately respond to various network attacks, and minimize the impact of network attacks on the Internet of Vehicles system.

[0156] In some embodiments, the system or the linkage processing module in the system is linked with security equipment (such as vehicle ECU, firewall, intrusion detection system, terminal security management system, etc.) to achieve centralized management and unified execution of security policies, which can quickly and effectively respond to various network security threats and achieve efficient network security protection.

[0157] As an example, when a serious cyber attack is detected that may affect the safety of vehicle driving, the linkage disposal module can integrate with the ECU to take measures such as limiting the vehicle speed and initiating emergency braking to ensure the safe operation of the vehicle.

[0158] As an example, working in conjunction with a firewall to achieve fine-grained control of network traffic, the linkage disposal module can, for example, enhance monitoring and blocking of specific types of network traffic through firewall filtering based on the type and severity of the threat.

[0159] As an example, the linkage handling module can also feed back the handling results to the intrusion detection system so that it can continuously optimize the detection algorithm and improve the detection accuracy.

[0160] In other embodiments, the defense measures in the intrusion response strategy have information on the defense level; the step 140 may specifically include: in step 141, based on the alarm information, analyzing the attack link of the network intrusion behavior to determine at least one attack process; in step 142, matching the defense measures of the corresponding defense level according to the attack process; in step 143, according to the attack process, sequentially executing the defense measures in the intrusion response strategy corresponding to the threat level to deal with the threat of the network intrusion behavior.

[0161] Since network intrusion attacks are often not a single behavior, but a complex chain consisting of multiple steps, by analyzing the composition of the attack, a more accurate defense strategy can be formulated. Setting specific protection measures for each step of the attack can intercept and block the attack at different levels.

[0162] Specifically, after identifying the network intrusion behavior, the entire process of the attack event is reflected through the security event data, and the composition of the behavior is analyzed. For example, if the attack has 1, 2, and 3 steps, there are three different protection measures (different defense measures have different levels), and each step of the attack behavior in the attack composition is defended one by one, thereby forming a multi-level defense system.

[0163] As an example, defense measures include management measures and technical measures. In terms of technical measures, for example, firewalls can issue rules through the platform, and vehicles can refresh the rules in time to achieve timely protection, which can quickly respond to changing attack situations. In addition, the adjustability of technical means enables flexible optimization and improvement in the face of attacks of different types and intensities, ensuring the security and stability of the Internet of Vehicles system. In terms of management measures, the security management of the Internet of Vehicles is regulated from the aspects of systems and processes.

[0164] In other embodiments, the system also supports a recall operation to ensure that the normal operation of the system can be quickly restored in the event of a false alarm or erroneous operation.

[0165] After step 140, the vehicle network intrusion response method further includes: in step 150, obtaining defense result data after executing the defense measures; in step 160, evaluating the defense result data according to preset evaluation indicators, generating a feedback report including the evaluation results, and outputting the feedback report.

[0166] After the disposal measures are implemented, the effectiveness evaluation is a key link to ensure the continued effective operation of the network security protection system. After the disposal measures are implemented, the system can evaluate the disposal effects to understand whether the measures taken have achieved the expected goals, timely discover potential problems and deficiencies, and provide a strong basis for subsequent improvements. At the same time, feedback reports are provided to relevant personnel. These reports not only include the implementation of disposal measures, but also include the comparison of security status before and after disposal, potential risk points, and subsequent recommended measures.

[0167] Regarding effect evaluation: the system will evaluate the defense data or defense effect after executing the defense measures according to the preset evaluation indicators. The evaluation indicators can be, but are not limited to, the blocking success rate (measures the effectiveness of the disposal measures in blocking the attack source), response time (reflects the system's response speed to security incidents), resource consumption (evaluates the occupation of system resources by the disposal measures), etc. These indicators will help users understand the actual effect of the disposal measures and provide reference for subsequent improvements.

[0168] Regarding feedback reports: After the evaluation is completed, the system will automatically generate a feedback report and send it to relevant personnel through various notification methods, which can ensure that relevant personnel receive the information on the disposal effect evaluation in a timely manner so that they can take further actions in a timely manner.

[0169] As an example, users can choose a suitable notification method according to their needs to improve the efficiency of information acquisition. The notification method may be, but is not limited to, notification methods such as email, WeChat, or DingTalk.

[0170] As an example, these reports record in detail the implementation process of defense measures (which may include but are not limited to the specific steps taken, the systems and equipment involved, etc.), the evaluation results and subsequent suggestions, providing users with comprehensive emergency response information. Among them, based on the evaluation results and the analysis of potential risk points, targeted subsequent recommended measures are proposed. These suggestions may include measures to further strengthen security protection, methods to optimize the disposal process, suggestions for improving system configuration, etc., providing users with a direction for continuous improvement of the network security protection system.

[0171] The embodiment of the vehicle network intrusion response method provided above aims to realize the rapid identification, analysis and emergency handling of automotive network security threats through the collaboration of highly automated processes and intelligent components. The monitoring, investigation, analysis and handling of security incidents are streamlined and automated, thereby significantly improving the efficiency and accuracy of automotive network security protection.

[0172] The present application provides a vehicle network intrusion response method, device and computer-readable storage medium, which are compared with the current insufficient defense capabilities of vehicle networks. Real-time analysis of security event data in the vehicle network is carried out to timely discover potential security risks and provide a basis for subsequent processing. Warning information is generated by analyzing security event data so that timely response can be made when network intrusion occurs, thereby improving the response speed. Thereafter, the warning information is deeply analyzed to determine whether it is a real threat, which can avoid unnecessary waste of resources caused by false alarms and ensure accurate response to real threats. Then, the threat level of the network intrusion behavior is determined in response to the result of whether the warning information is a real threat, so that the assessment of security events is more accurate and corresponding measures can be taken according to different threat levels. The defense measures in the intrusion response strategy corresponding to the threat level can effectively respond to the threat of network intrusion behavior and minimize the damage of the intrusion behavior to the vehicle network and the impact on the safety of vehicles and passengers. Thereby, the security and reliability of the vehicle network are improved as a whole, providing a strong guarantee for the safe driving of intelligent networked vehicles.

[0173] Based on the above first embodiment, a second embodiment of a vehicle network intrusion response method is proposed. The second embodiment is used to illustrate a calibration method when both the target sensor and the sensor to be calibrated are laser radars.

[0174] Based on the same application concept as the above method, the present application embodiment also proposes a vehicle network intrusion response device, such as Figure 3 shown.

[0175] The device comprises:

[0176] An alarm generation module 402 is used to analyze security event data in the vehicle network and generate alarm information based on the security event data that identifies network intrusion behavior;

[0177] An alarm analysis module 404 is used to determine whether the alarm information is a real threat;

[0178] A threat determination module 406, configured to determine the threat level of the network intrusion behavior in response to a result of whether the alarm information is a real threat;

[0179] The security defense module 408 is used to execute the defense measures in the intrusion response strategy corresponding to the threat level to deal with the threat of the network intrusion behavior.

[0180] The implementation process of the functions and effects of each module / submodule / unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and the same technical effect can be achieved, so it will not be repeated here.

[0181] Figure 4An example of a physical structure diagram of a vehicle network intrusion response device is shown in FIG. Figure 4 As shown, the vehicle network intrusion response device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the vehicle network intrusion response method.

[0182] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0183] On the other hand, the present application also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the vehicle network intrusion response method provided by the above-mentioned methods.

[0184] On the other hand, the present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the vehicle network intrusion response method provided by the above-mentioned methods.

[0185] It should be noted that the technical solutions or technical features described in the above embodiments can be combined or supplemented with each other without causing conflicts. The scope of protection of this application is not limited to the precise structures described in the above embodiments and shown in the drawings; all modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this application should be included in the scope of protection of this application.

Claims

1. A vehicle network intrusion response method, characterized in that: The method comprises: Analyze security event data in the vehicle network and generate warning information based on security event data that identifies network intrusion behavior; Determining whether the warning information is a real threat; In response to whether the warning information is a real threat, determining the threat level of the network intrusion behavior; Execute the defense measures in the intrusion response strategy corresponding to the threat level to deal with the threat of the network intrusion behavior.

2. The vehicle network intrusion response method as claimed in claim 1, characterized in that: The determining whether the warning information is a real threat includes: Acquire a threat intelligence library, wherein the threat intelligence library includes at least one known threat information related to vehicle network security; the threat intelligence library includes any one of retrieval behavior records, hacker activity characteristics, and resource information provided by hackers collected from the vehicle network; Determine whether the warning information matches known threat information in the threat intelligence library, and determine whether the warning information is a real threat.

3. The vehicle network intrusion response method as claimed in claim 2, characterized in that: The warning information includes multi-dimensional warning attributes; The determining whether the warning information matches known threat information in the threat intelligence library and determining whether the warning information is a real threat includes: Filtering the alarm information based on the multi-dimensional alarm attributes of the alarm information according to the filtering conditions associated with the alarm screening attributes related to the vehicle network; Determine whether the filtered alarm information hits the known threat information in the threat intelligence library, and determine whether the alarm information is a real threat.

4. The vehicle network intrusion response method as claimed in claim 2, characterized in that: The warning information includes warning content; The determining whether the warning information matches known threat information in the threat intelligence library and determining whether the warning information is a real threat includes: Selecting content from the alarm content for analysis based on a unique source of data and / or data integrity; The selected content is matched with corresponding content in the known threat information to determine whether the warning information is a real threat.

5. The vehicle network intrusion response method as claimed in claim 4, characterized in that: The alarm information also includes multi-dimensional alarm attributes; The matching of the selected content with corresponding content in the known threat information to determine whether the warning information is a real threat includes: Matching the selected content with corresponding content in the known threat information to determine the matched alarm information; According to the filtering conditions associated with the alarm screening attributes related to the vehicle network, based on the multi-dimensional alarm attributes of the alarm information, filtering the matched alarm information; Determine whether the filtered alert information is a real threat.

6. The vehicle network intrusion response method as claimed in claim 1, characterized in that: The step of determining the threat level of the network intrusion behavior in response to whether the alarm information is a real threat includes: In response to the alarm information being a real threat, a first threat level of the network intrusion behavior is determined, the first threat level being determined according to the threat level of known threat information matching the alarm information in a threat intelligence library; the threat intelligence library includes at least one known threat information related to vehicle network security, and the threat intelligence library includes any content collected from the vehicle network about retrieval behavior records, hacker activity characteristics, and resource information provided by hackers.

7. The vehicle network intrusion response method as claimed in claim 1, characterized in that: The step of determining the threat level of the network intrusion behavior in response to whether the alarm information is a real threat includes: In response to the alarm information being a non-real threat, a second threat level of the network intrusion behavior is determined, where the second threat level is determined according to the threat level of the alarm information.

8. The vehicle network intrusion response method as claimed in claim 7, characterized in that: In response to the alarm information being a non-real threat, determining a second threat level of the network intrusion behavior includes: In response to the warning information being a non-real threat, a second threat level of the network intrusion behavior is determined, wherein the second threat level is determined based on a comprehensive analysis of the warning information and status information of a current intrusion protection system of the vehicle.

9. The vehicle network intrusion response method as claimed in claim 1, characterized in that: The analysis of the security event data in the vehicle network and the generation of warning information based on the security event data identifying the network intrusion behavior include: Through the preset intrusion detection model, the security event data in the vehicle network is analyzed, and alarm information is generated based on the security event data that identifies network intrusion behavior; The intrusion detection model is trained by historical security event data and historical analysis results.

10. The vehicle network intrusion response method as claimed in claim 1, characterized in that: The defense measures in the intrusion response strategy have information about the defense level; The executing of the defense measures in the intrusion response strategy corresponding to the threat level, used to deal with the threat of the network intrusion behavior, includes: Based on the alarm information, analyzing the attack link of the network intrusion behavior to determine at least one attack process; Matching defense measures of corresponding defense levels according to the attack process; According to the attack process, the defense measures in the intrusion response strategy corresponding to the threat level are executed in sequence to deal with the threat of the network intrusion behavior.

11. The vehicle network intrusion response method as claimed in claim 1, characterized in that: After executing the defense measures in the intrusion response strategy corresponding to the threat level to cope with the threat of the network intrusion behavior, the method further includes: Obtaining defense result data after executing the defense measures; The defense result data is evaluated according to preset evaluation indicators, a feedback report including the evaluation results is generated, and the feedback report is output.

12. A vehicle network intrusion response device, characterized in that: It includes a memory, a processor, and a vehicle network intrusion response program stored in the memory and executable on the processor. When the processor executes the vehicle network intrusion response program, the steps of the vehicle network intrusion response method as described in any one of claims 1 to 11 are implemented.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a vehicle network intrusion response program, and when the vehicle network intrusion response program is executed, the steps of the vehicle network intrusion response method as described in any one of claims 1-11 are implemented.

Images