Identification method and device for attack path of vehicle, vehicle and storage medium
By automating the analysis of vehicle data flow graph dependencies and path identification models, the problem of easily overlooking attack paths during manual identification is solved, achieving efficient and accurate attack path identification and ensuring vehicle network security.
Patent Information
- Application Number
- CN202511421578.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-29
- Publication Date
- 2025-12-09
AI Technical Summary
In existing technologies, for complex vehicle data flow graphs, manual identification of attack paths is prone to omissions, which may result in the final identified attack path not being optimal, thus affecting the formulation of security measures for vehicle network security.
By automating the analysis of dependencies between data flow graphs, multiple attack paths are output using a path identification model. Based on feasibility scores and the frequency of attack path occurrences, the most suitable template attack path is determined, reducing human interference and ensuring the accuracy and completeness of the identification results.
It improves the efficiency and accuracy of attack path identification, ensuring no omissions, and provides the optimal risk control solution to protect vehicle network security.
Smart Images
Figure CN121098609A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of digital information transmission technology, and in particular to a method, apparatus, vehicle, and storage medium for identifying attack paths of vehicles. Background Technology
[0002] Threat analysis and security assessment are important means to ensure vehicle cybersecurity, so as to effectively identify and manage cybersecurity risks.
[0003] In related technologies, data flow graphs are used to calculate the attack paths of each component, and then manual identification of the attack paths of each component is required. For complex data flow graphs, the data volume is extremely large, and manual identification is prone to missing some attack paths, so the final identified attack paths may not be optimal, which in turn affects the formulation of the final security measures and is not conducive to ensuring the network security of vehicles. This needs to be improved urgently. Summary of the Invention
[0004] This application provides a method, apparatus, vehicle, and storage medium for identifying attack paths of a vehicle, in order to solve the technical problem in related technologies where, for complex data flow graphs, manual identification of attack paths is prone to omissions, resulting in the final identified attack path not being optimal, which in turn affects the formulation of final security measures and is detrimental to ensuring the network security of the vehicle.
[0005] The first aspect of this application provides a method for identifying attack paths of a vehicle, comprising the following steps: acquiring system data of a target vehicle and generating a data flow graph of the target vehicle using the system data; defining components in the data flow graph to determine the dependencies between the components, labeling the components based on a preset classification, identifying the attributes of the components, and converting the data flow graph into an attribute graph by combining the dependencies and the attributes; inputting the attribute graph into a pre-constructed path identification model to output multiple attack paths of the target vehicle; scoring the attack feasibility of the multiple attack paths, including high-risk attack paths that meet preset high feasibility conditions into a calculation pool, and calculating the occurrence count of attack links of all high-risk attack paths in the calculation pool, and determining the target attack path that meets the preset maximum attack link condition based on the occurrence count.
[0006] Based on the above technical means, the embodiments of this application can automatically analyze the dependencies between data flow graphs, thereby using the path recognition model to output multiple attack paths, improve recognition efficiency, reduce interference from human factors, make the analysis results more objective and accurate, ensure that the attack path analysis is efficient and without omissions, and on this basis, determine the most suitable template attack link according to the feasibility score and the number of times the attack link appears, so as to facilitate the subsequent security protection of the target vehicle.
[0007] Optionally, in one embodiment of this application, the step of inputting the attribute graph into a pre-built path recognition model to obtain multiple attack paths of the target vehicle includes: taking the external interface of the target vehicle as the starting point of each attack path, and calculating all paths from each starting point to the target component based on the communication link of each starting point under the constraints of pre-built rules; exhaustively enumerating paths based on preset attack link determination rules to obtain the multiple attack paths.
[0008] Based on the above technical means, the embodiments of this application can use a path recognition model to solve the problem of not being able to exhaustively list paths, so that the automatic identification of attack paths can be realized. At the same time, the path recognition model can ensure that the identified paths cover all medium and high risk paths, so as to ensure that no subsequent risks are missed.
[0009] Optionally, in one embodiment of this application, the pre-built rule constraints include at least one of the following constraints: the attack level is less than a preset number, wherein the attack level is obtained by the number of electronic control unit nodes passed through by the attack path; each path does not repeatedly pass through the same electronic control unit; the in-vehicle network communication protocol belongs to one of controller area network, flexible data rate controller area network and Ethernet.
[0010] Based on the above technical means, the embodiments of this application can set rule constraints to make the attack path analysis more closely match the actual topology and security characteristics of the vehicle network, and finally output a high-value attack path that meets both theoretical requirements and engineering feasibility.
[0011] Optionally, in one embodiment of this application, the exhaustive path enumeration based on preset attack link determination rules includes: determining whether the communication protocol of the in-vehicle attack link is Ethernet; if the communication protocol is Ethernet, then determining that the in-vehicle attack link continues to the next level of attack.
[0012] Based on the above technical means, the embodiments of this application can determine whether the next level of attack can be determined according to the attack chain determination rules, so as to further improve the identification accuracy of the attack chain level.
[0013] Optionally, in one embodiment of this application, obtaining the target attack path that satisfies the preset maximum attack link condition based on the number of occurrences includes: filtering out multiple attack paths to be determined from the high-risk attack paths that contain the attack link corresponding to the maximum number of occurrences; and selecting the attack path with the smallest attack level from the multiple attack paths to be determined as the target attack path.
[0014] Based on the above technical means, the embodiments of this application can identify the target attack path from the computing pool based on the parameter of the number of times the attack link appears, combined with the attack path to which the attack link belongs, through an identification algorithm, so as to facilitate subsequent security protection for the target vehicle.
[0015] Optionally, in one embodiment of this application, the method further includes: generating a corresponding attack path blocking action based on the target attack path; and using the attack path blocking action to block the target attack path until the target vehicle meets a preset safety condition.
[0016] Based on the above technical means, the embodiments of this application can find an effective solution for risk control according to the target attack path, thereby ensuring the network security of the target vehicle.
[0017] A second aspect of this application provides a device for identifying attack paths of a vehicle, comprising: an acquisition module for acquiring system data of a target vehicle and generating a data flow graph of the target vehicle using the system data; a definition module for defining components in the data flow graph to determine the dependencies between the components, labeling the components based on a preset classification, identifying the attributes of the components, and converting the data flow graph into an attribute graph by combining the dependencies and the attributes; a calculation module for inputting the attribute graph into a pre-built path identification model to output multiple attack paths of the target vehicle; and an identification module for scoring the attack feasibility of the multiple attack paths, including high-risk attack paths that meet preset high feasibility conditions in a calculation pool, calculating the occurrence count of attack links of all high-risk attack paths in the calculation pool, and determining a target attack path that meets a preset maximum attack link condition based on the occurrence count.
[0018] Optionally, in one embodiment of this application, the calculation module includes: a calculation unit, used to take the external interface of the target vehicle as the starting point of each attack path, and calculate all paths from each starting point to the target component based on the communication link of each starting point under the constraints of pre-built rules; and an exhaustive enumeration unit, used to exhaustively enumerate paths based on preset attack link determination rules to obtain the multiple attack paths.
[0019] Optionally, in one embodiment of this application, the pre-built rule constraints include at least one of the following constraints: the attack level is less than a preset number, wherein the attack level is obtained by the number of electronic control unit nodes passed through by the attack path; each path does not repeatedly pass through the same electronic control unit; the in-vehicle network communication protocol belongs to one of controller area network, flexible data rate controller area network and Ethernet.
[0020] Optionally, in one embodiment of this application, the exhaustive search unit includes: a judgment subunit, used to determine whether the communication protocol of the in-vehicle attack link is Ethernet; and a determination subunit, used to determine that the in-vehicle attack link continues to the next level of attack if the communication protocol is Ethernet.
[0021] Optionally, in one embodiment of this application, the identification module includes: a filtering unit, configured to filter out multiple attack paths to be determined that contain the attack link corresponding to the maximum occurrence frequency from the high-risk attack paths; and a selection unit, configured to select the attack path with the smallest attack level from the multiple attack paths to be determined as the target attack path.
[0022] Optionally, in one embodiment of this application, it further includes: a generation module, used to generate a corresponding attack path blocking action based on the target attack path; and a blocking module, used to block the target attack path using the attack path blocking action until the target vehicle meets a preset security condition.
[0023] A third aspect of this application provides a vehicle, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the vehicle attack path identification method as described in the above embodiments.
[0024] A fourth aspect of this application provides a computer-readable storage medium storing computer instructions for causing the computer to execute the vehicle attack path identification method as described in the above embodiments.
[0025] A fifth aspect of this application provides a computer program product, including a computer program, which, when executed, is used to implement the above-described method for identifying the attack path of a vehicle.
[0026] This application's embodiments can automatically analyze the dependencies between data flow graphs, thereby outputting multiple attack paths using a path recognition model. This improves recognition efficiency, reduces human interference, and makes the analysis results more objective and accurate, ensuring efficient and comprehensive attack path analysis. Based on this, the most suitable template attack path is determined according to feasibility scores and the frequency of attack link occurrences, facilitating subsequent security protection for the target vehicle. This solves the technical problem in related technologies where, for complex data flow graphs, manual identification of attack paths is prone to omissions, resulting in potentially unoptimal identified attack paths, which in turn affects the formulation of final security measures and hinders the protection of vehicle network security.
[0027] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description
[0028] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart illustrating a method for identifying attack paths of a vehicle according to an embodiment of this application. Figure 2 This is a schematic diagram of an attack hierarchy provided according to an embodiment of this application; Figure 3 A flowchart of a method for identifying attack paths of a vehicle according to an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a vehicle attack path identification device according to an embodiment of this application; Figure 5 This is a structural schematic diagram of a vehicle provided according to an embodiment of this application. Detailed Implementation
[0029] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.
[0030] The following description, with reference to the accompanying drawings, outlines a method, apparatus, vehicle, and storage medium for identifying vehicle attack paths according to embodiments of this application. Addressing the technical problem mentioned in the background art, where manual identification of attack paths in complex data flow graphs is prone to omissions, the final identified attack path may not be optimal, thus affecting the formulation of final security measures and hindering the protection of vehicle network security, this application provides a method for identifying vehicle attack paths. This method automatically analyzes the dependencies between data flow graphs, thereby using a path identification model to output multiple attack paths, improving identification efficiency and reducing human interference. This makes the analysis results more objective and accurate, ensuring efficient and comprehensive attack path analysis. Based on this, the most suitable template attack link is determined according to feasibility scores and the frequency of attack link occurrences, facilitating subsequent security protection of the target vehicle. This solves the technical problem in related technologies where manual identification of attack paths in complex data flow graphs is prone to omissions, resulting in the final identified attack path not being optimal, thus affecting the formulation of final security measures and hindering the protection of vehicle network security.
[0031] Understandably, current vehicles are highly electrified, and data flow diagrams involve large amounts of data and complex logic. Manually identifying attack paths for each component requires using Excel spreadsheets, manually analyzing the data flow, and listing possible attack paths in an itemized manner. This is tedious and inefficient, typically only able to list a limited number of attack paths, and often requires human judgment to check for omissions. This leads to inconsistent task completion rates among individuals, resulting in low efficiency and potentially poor quality. Furthermore, manual attack path identification cannot effectively analyze the optimal attack path, making it difficult to derive the optimal solution for risk control.
[0032] To address the aforementioned technical issues, embodiments of this application can automatically calculate the dependencies between components based on the connection relationships between data flow graphs, reducing manual parameters. Furthermore, by utilizing the dependencies between components and associating component information in the knowledge base, attack paths can be automatically calculated. Simultaneously, scoring and other information are automatically incorporated to identify the optimal vehicle attack path and find the optimal solution for risk control.
[0033] Specifically, Figure 1 This is a flowchart illustrating a method for identifying attack paths of a vehicle, as provided in an embodiment of this application.
[0034] like Figure 1 As shown, the method for identifying the attack path of this vehicle includes the following steps: In step S101, the system data of the target vehicle is acquired, and the data flow diagram of the target vehicle is generated using the system data.
[0035] In actual implementation, the embodiments of this application can acquire various system data of the target vehicle, such as vehicle system architecture documents (vehicle electrical architecture diagram, functional description of each domain controller, network topology diagram, etc.), component specifications (detailed functions, interfaces, and communication protocols of electronic control units; types, data formats, and connection methods of sensors / actuators; configuration rules of gateways, firewall policies, etc.), communication protocol specifications, security requirements and analysis documents, etc.
[0036] Based on various system data, embodiments of this application can utilize tools such as drawio to draw data flow diagrams, clearly demonstrating the relationships and data flow between various components involved in the function based on the function definition.
[0037] In step S102, components in the data flow diagram are defined to determine the dependencies between components, and the attributes of components are identified based on preset classification and labeling of components, so as to combine dependencies and attributes to transform the data flow diagram into an attribute diagram.
[0038] In this context, "components" refers to valuable entities or functions within a vehicle system that require protection or may be exploited by attackers. They serve as targets or springboards for attacks. For example, physical components may include engine control modules, brake control modules, infotainment systems, gateways, T-Boxes, radar sensors, cameras, network buses, wireless interfaces, battery management systems, etc.; data components may include vehicle control commands (acceleration, braking, steering), sensitive data (location information, driving habits, user identity, biometrics), security credentials (encryption keys, certificates), diagnostic codes, firmware, etc.; and functional components may include remote start, door unlocking, autonomous driving functions, software update services, diagnostic services, etc.
[0039] Data flow diagrams allow you to define components, select the correct component models, and display the relationships and data flow between various components. Component models represent specific implementation versions or variants of a particular component, enabling technical professionals to query known vulnerabilities, exploitable interfaces, and default configuration weaknesses of that model, thereby assessing its vulnerability and role in the attack path.
[0040] The connections, interactions, or dependencies between components. This defines the possible paths through which data (including attack payloads) flows within the system or across system boundaries. Relationships between components can include physical connections (directly connected via a specific bus or cable), logical connections (communication via network protocols), trust relationships (whether a component trusts data or instructions from another component), and dependencies (the requirement of another component to provide services or data for the functionality of one component).
[0041] In a data flow diagram, the direction and content of data flow can be the information or instructions actually transmitted between components. This includes legitimate data flows as well as potential attack vector paths.
[0042] By combining the above content and labeling the attributes of components, the data flow diagram can be transformed into an attribute diagram to more clearly represent the component attributes, component relationships, and other information of the target vehicle.
[0043] Furthermore, in this embodiment, all components in the data flow diagram can be categorized and labeled. Label parameters O are defined, with O1 representing external interfaces, O2 representing electronic control units (ECUs), and O3 representing communication links—three categories in total. All components already drawn in the data flow diagram in the first step need to select the corresponding label parameter O as one of the component's attributes.
[0044] In step S103, the attribute graph is input into the pre-built path recognition model to output multiple attack paths of the target vehicle.
[0045] In practical implementation, this application embodiment can establish a path recognition model to solve the problem of being unable to exhaustively list paths, enabling automatic identification of attack paths. Simultaneously, the path recognition model ensures that the identified paths cover all medium- and high-risk paths, guaranteeing that no subsequent risks are overlooked. Secondly, the development of this model needs to be automated and applied to the threat analysis and security assessment system. This application embodiment can input the transformed attribute graph into the path recognition model to obtain multiple attack paths for the target vehicle, avoiding omissions.
[0046] For example, the path identification model can have the following four constraints: ① The attack level M is within 5 (the number of ECUs traversed by the path is greater than or equal to 1 and less than or equal to 5); ② The ECUs in the path cannot be repeated; ③ The in-vehicle attack link type only considers CAN / CANFD / ETH; ④ There are constraints on the in-vehicle attack links at each level in the attack path (there are no constraints on the external attack link type). Each attack path needs to start from the external interface and recursively calculate all paths from the external interface to the selected asset according to the connected communication links, exhaustively enumerating the paths and numbering the attack links traversed by the path as N; at the same time, rules need to be formulated for the exhaustive method. When the in-vehicle attack link is ETH, the next level of attack can continue; otherwise, the next level of attack cannot continue.
[0047] Optionally, in one embodiment of this application, the attribute graph is input into a pre-built path recognition model to obtain multiple attack paths of the target vehicle, including: taking the external interface of the target vehicle as the starting point of each attack path, and calculating all paths from each starting point to the target component based on the communication link of each starting point under the constraints of pre-built rules; exhaustively enumerating paths based on preset attack link determination rules to obtain multiple attack paths.
[0048] As one possible implementation, embodiments of this application can take the external interface of each attack path as the starting point, and recursively calculate all paths from the external interface to the selected component under rule constraints, according to the connected communication links.
[0049] Optionally, in one embodiment of this application, the pre-built rule constraints include at least one of the following constraints: the attack level is less than a preset number, wherein the attack level is obtained by the number of electronic control unit nodes passed through by the attack path; each path does not repeatedly pass through the same electronic control unit; the in-vehicle network communication protocol belongs to one of Controller Area Network, Flexible Data Rate Controller Area Network, and Ethernet.
[0050] For example, a path recognition model can have the following four constraints: ① Figure 2As shown, the attack level M is within 5 (the number of electronic control units passed through the path is greater than or equal to 1 and less than or equal to 5), ② the electronic control units passed through cannot be repeated to prevent infinite loops, which is consistent with real attack scenarios, ③ the in-vehicle attack link types only consider Controller Area Network (CAN), Flexible Data Rate Controller Area Network (CANFD) and Ethernet (ETH), and ④ the in-vehicle attack links at each level in the attack path are constrained (the types of external attack links are unconstrained).
[0051] Optionally, in one embodiment of this application, exhaustively searching for paths based on preset attack link determination rules includes: determining whether the communication protocol of the in-vehicle attack link is Ethernet; if the communication protocol is Ethernet, then determining that the in-vehicle attack link continues to the next level of attack.
[0052] In some embodiments, the present application can exhaustively enumerate paths and number the attack links traversed by the path as N; at the same time, rules need to be formulated for the exhaustive method. When the in-vehicle attack link is Ethernet (ETH), the next level of attack can continue; otherwise, the next level of attack cannot continue.
[0053] In step S104, the attack feasibility of multiple attack paths is scored, high-risk attack paths that meet the preset high feasibility conditions are included in the calculation pool, and the occurrence number of attack links of all high-risk attack paths in the calculation pool is calculated. Based on the occurrence number, the target attack path that meets the preset maximum attack link condition is determined.
[0054] Furthermore, in this embodiment, the attack paths automatically identified in the above steps and the attack feasibility scores corresponding to each attack link within those paths (e.g., scores can be based on CVSS or attack potential) can be combined to include high-risk paths in the calculation pool. Next, a calculation model is established to calculate the number of attack links appearing on all paths in the pool. Specifically, this involves traversing all attack paths in the calculation pool and counting the attack links contained within each path by X. Each time an attack path passes through an attack link, X is incremented by 1. Finally, based on the attack link appearance count parameter and the attack path to which the attack link belongs, a recognition algorithm is used to identify the target attack path from the pool.
[0055] Optionally, in one embodiment of this application, obtaining a target attack path that satisfies the preset maximum attack link condition based on the number of occurrences includes: filtering out multiple attack paths to be determined from high-risk attack paths that contain the attack link corresponding to the maximum number of occurrences; and selecting the attack path with the smallest attack level from the multiple attack paths to be determined as the target attack path.
[0056] After traversing the computation pool using a computational model, this embodiment of the application can identify the optimal attack path from the computation pool using an identification algorithm. For example, this embodiment of the application can establish a computational model, traverse multiple attack paths in the computation pool, and count the attack links contained in the attack path by X. Each time the attack path passes through an attack link, X+1 is incremented. Finally, the target attack path is identified from the computation pool using an identification algorithm. This identification algorithm mainly relies on the following two conditions: ① the target attack path should contain the attack link corresponding to the maximum value of X; ② the attack path with the smallest attack level M value should be selected from the paths containing the maximum value of X.
[0057] Optionally, in one embodiment of this application, the method further includes: generating a corresponding attack path blocking action based on the target attack path; using the attack path blocking action to block the target attack path until the target vehicle meets the preset safety conditions.
[0058] The embodiments of this application can dissect the target attack path to identify key points of the path and determine the blocking position as shown in Table 1, wherein Table 1 is a reference table for selecting the blocking position.
[0059] Table 1
[0060] For communication layer blocking, embodiments of this application can block accordingly based on the communication protocol. For example, for Controller Area Network (CAN) and Flexible Data Rate Controller Area Network (CANFD), blocking is achieved by adding message authentication, and for Ethernet (ETH), blocking is achieved by enabling TLS 1.3.
[0061] For node-level blocking, the embodiments of this application can perform corresponding blocking according to the component type. For example, for T-Box, firmware secure boot and remote authentication are used for blocking; for gateway, cross-domain firewall is used for blocking; and for electronic control unit, runtime integrity monitoring is used for blocking.
[0062] For architecture-level blocking, the embodiments of this application can perform new user boundary reconstruction (such as adding hardware security modules), communication matrix optimization (such as setting whitelists for key signals), and defense in depth (such as deploying multi-layer detection mechanisms: bus anomaly detection, electronic control unit behavior analysis, cloud threat intelligence linkage, etc.).
[0063] Combination Figure 3 As shown, the working principle of the vehicle attack path identification method of this application embodiment is explained in detail with an example.
[0064] like Figure 3 As shown, embodiments of this application may include the following steps: Step S301: Draw a data flow diagram. Use drawio to draw a data flow diagram, clearly showing the relationships and data flow between various components involved in the function based on the function definition.
[0065] Step S302: Define the components in the data flow diagram, label them, and classify them into three categories: external interface, electronic control unit, and communication link.
[0066] Step S303: Automatically identify attack paths. First, a path identification model needs to be established. This model must address the problem of not being able to exhaustively list all paths, enabling automatic identification of attack paths. Simultaneously, the model must ensure that the identified paths cover all medium- and high-risk paths to guarantee that no subsequent risks are overlooked. Second, the development of this model needs to be automated and applied to the threat analysis and security assessment system.
[0067] Step S304: Identify the optimal attack path. First, the computation pool needs to be identified. Combining the attack paths automatically identified in step three and the attack feasibility scores corresponding to each attack link within those paths, high-risk paths are included in the computation pool. Second, a computational model is established to calculate the frequency of attack links for all paths in the pool. Finally, based on the frequency of attack link occurrences and the attack paths to which those links belong, an identification algorithm is used to identify the optimal attack path from the pool.
[0068] In summary, the embodiments of this application can automatically analyze the dependencies between data flow graphs to generate attack paths. This automation not only improves efficiency but also reduces interference from human factors, making the analysis results more objective and accurate, ensuring efficient and comprehensive attack path analysis. The embodiments of this application propose a path identification model, achieving accurate automation through the setting of constraint rules. Based on this, identifying target attack paths helps to efficiently handle threats and formulate corresponding protective measures, providing an optimal solution for vehicle information security protection. The embodiments of this application, through computational models and identification algorithms, ensure the reliability and efficiency of optimal attack path identification.
[0069] The vehicle attack path identification method proposed in this application can automatically analyze the dependencies between data flow graphs, thereby outputting multiple attack paths using a path identification model. This improves identification efficiency, reduces human interference, and makes the analysis results more objective and accurate, ensuring efficient and comprehensive attack path analysis. Based on this, the most suitable template attack link is determined according to feasibility scores and the frequency of attack link occurrences, facilitating subsequent security protection for the target vehicle. This solves the technical problem in related technologies where, for complex data flow graphs, manual identification of attack paths is prone to omissions, resulting in potentially unoptimal identified attack paths that affect the formulation of final security measures and hinder the protection of vehicle network security.
[0070] Next, referring to the accompanying drawings, a vehicle attack path identification device according to an embodiment of this application is described.
[0071] Figure 4 This is a block diagram of a vehicle attack path identification device according to an embodiment of this application.
[0072] like Figure 4 As shown, the vehicle attack path identification device 10 includes: an acquisition module 100, a definition module 200, a calculation module 300, and an identification module 400.
[0073] Specifically, the acquisition module 100 is used to acquire system data of the target vehicle and generate a data flow diagram of the target vehicle using the system data.
[0074] The definition module 200 is used to define the components in the data flow diagram to determine the dependencies between components, and to identify the attributes of the components based on the preset classification and labeling of the components, so as to combine the dependencies and attributes to transform the data flow diagram into an attribute diagram.
[0075] The calculation module 300 is used to input the attribute graph into a pre-built path recognition model to output multiple attack paths of the target vehicle.
[0076] The identification module 400 is used to score the attack feasibility of multiple attack paths, include high-risk attack paths that meet the preset high feasibility conditions into the calculation pool, and calculate the occurrence number of attack links of all high-risk attack paths in the calculation pool. Based on the occurrence number, the target attack path that meets the preset maximum attack link condition is determined.
[0077] Optionally, in one embodiment of this application, the calculation module 300 includes a calculation unit and an exhaustive search unit.
[0078] The computing unit is used to take the external interface of the target vehicle as the starting point of each attack path, and calculate all paths from each starting point to the target component by recursively calculating the communication link of each starting point under the constraints of pre-built rules.
[0079] The exhaustive unit is used to exhaustively search for paths based on preset attack link determination rules in order to obtain multiple attack paths.
[0080] Optionally, in one embodiment of this application, the pre-built rule constraints include at least one of the following constraints: the attack level is less than a preset number, wherein the attack level is obtained by the number of electronic control unit nodes traversed by the attack path. Each path does not repeatedly pass through the same electronic control unit. The in-vehicle network communication protocol belongs to one of Controller Area Network (CAN), Flexible Data Rate Controller Area Network (FDR), and Ethernet.
[0081] Optionally, in one embodiment of this application, the exhaustive unit includes: a judgment subunit and a determination subunit.
[0082] The judgment subunit is used to determine whether the communication protocol of the in-vehicle attack link is Ethernet.
[0083] The sub-unit is used to determine the in-vehicle attack link to continue the attack to the next level when the communication protocol is Ethernet.
[0084] Optionally, in one embodiment of this application, the identification module 400 includes a filtering unit and a selection unit.
[0085] The filtering unit is used to filter out multiple attack paths to be judged from high-risk attack paths, including the attack link corresponding to the maximum number of occurrences.
[0086] The selection unit is used to select the attack path with the lowest attack level from multiple attack paths to be determined as the target attack path.
[0087] Optionally, in one embodiment of this application, the vehicle attack path identification device 10 further includes a generation module and a blocking module.
[0088] The generation module is used to generate corresponding attack path blocking actions based on the target attack path.
[0089] The blocking module is used to block the target's attack path using attack path blocking actions until the target vehicle meets preset security conditions.
[0090] It should be noted that the explanation of the aforementioned method embodiment for identifying vehicle attack paths also applies to the vehicle attack path identification device of this embodiment, and will not be repeated here.
[0091] The vehicle attack path identification device proposed in this application can automatically analyze the dependencies between data flow graphs, thereby outputting multiple attack paths using a path identification model. This improves identification efficiency, reduces human interference, and makes the analysis results more objective and accurate, ensuring efficient and comprehensive attack path analysis. Based on this, the device determines the most suitable template attack link according to feasibility scores and the frequency of attack link occurrences, facilitating subsequent security protection for the target vehicle. This solves the technical problem in related technologies where, for complex data flow graphs, manual identification easily misses some attack paths, resulting in potentially unoptimal identified attack paths, which in turn affects the formulation of final security measures and hinders the protection of vehicle network security.
[0092] Figure 5 A schematic diagram of the structure of a vehicle provided in an embodiment of this application. The vehicle may include: The memory 501, the processor 502, and the computer program stored on the memory 501 and capable of running on the processor 502.
[0093] When the processor 502 executes the program, it implements the method for identifying the attack path of the vehicle provided in the above embodiments.
[0094] Furthermore, the vehicle also includes: Communication interface 503 is used for communication between memory 501 and processor 502.
[0095] The memory 501 is used to store computer programs that can run on the processor 502.
[0096] Memory 501 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.
[0097] If the memory 501, processor 502, and communication interface 503 are implemented independently, then the communication interface 503, memory 501, and processor 502 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 5 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.
[0098] Optionally, in a specific implementation, if the memory 501, processor 502, and communication interface 503 are integrated on a single chip, then the memory 501, processor 502, and communication interface 503 can communicate with each other through an internal interface.
[0099] Processor 502 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.
[0100] This embodiment also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for identifying vehicle attack paths.
[0101] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the vehicle attack path identification method provided in this embodiment of the invention.
[0102] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.
[0103] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.
[0104] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.
[0105] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.
[0106] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.
[0107] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it includes one or a combination of the steps of the method embodiments.
[0108] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.
[0109] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.
Claims
1. A method for identifying the attack path of a vehicle, characterized in that, Includes the following steps: Acquire system data of the target vehicle, and use the system data to generate a data flow diagram of the target vehicle; Define the components in the data flow graph to determine the dependencies between the components, label the components based on a preset classification, identify the attributes of the components, and combine the dependencies and the attributes to transform the data flow graph into an attribute graph; The attribute graph is input into a pre-built path recognition model to output multiple attack paths for the target vehicle; The attack feasibility of the multiple attack paths is scored, and high-risk attack paths that meet the preset high feasibility conditions are included in the calculation pool. The occurrence frequency of attack links of all high-risk attack paths in the calculation pool is calculated, and the target attack path that meets the preset maximum attack link condition is determined based on the occurrence frequency.
2. The method according to claim 1, characterized in that, The step of inputting the attribute graph into a pre-built path recognition model to obtain multiple attack paths for the target vehicle includes: Using the external interface of the target vehicle as the starting point of each attack path, and under the constraints of pre-built rules, all paths from each starting point to the target component are calculated recursively based on the communication link of each starting point. The multiple attack paths are obtained by exhaustively searching for paths based on preset attack link determination rules.
3. The method according to claim 2, characterized in that, The pre-built rule constraints include at least one of the following constraints: The attack level is less than a preset level, wherein the attack level is obtained by the number of electronic control unit nodes through which the attack path passes; Each path must not repeatedly pass through the same electronic control unit; The in-vehicle network communication protocol belongs to one of the following: Controller Area Network (CAN), Flexible Data Rate Controller Area Network (FDR), and Ethernet.
4. The method according to claim 3, characterized in that, The exhaustive path enumeration based on preset attack link determination rules includes: Determine whether the communication protocol of the in-vehicle attack link is Ethernet; If the communication protocol is Ethernet, then the in-vehicle attack link is determined to continue to the next level of attack.
5. The method according to claim 1, characterized in that, The method of obtaining the target attack path that satisfies the preset maximum attack link condition based on the number of occurrences includes: Multiple attack paths to be judged are selected from the high-risk attack paths, including the attack link corresponding to the maximum occurrence frequency. The attack path with the lowest attack level among the multiple attack paths to be determined is selected as the target attack path.
6. The method according to claim 1, characterized in that, Also includes: Generate corresponding attack path blocking actions based on the target attack path; The attack path blocking action is used to block the target attack path until the target vehicle meets the preset security conditions.
7. A device for identifying the attack path of a vehicle, characterized in that, include: An acquisition module is used to acquire system data of the target vehicle and generate a data flow diagram of the target vehicle using the system data; A definition module is used to define the components in the data flow graph to determine the dependencies between the components, label the components based on a preset classification, identify the attributes of the components, and combine the dependencies and the attributes to transform the data flow graph into an attribute graph. The calculation module is used to input the attribute graph into a pre-built path recognition model to output multiple attack paths of the target vehicle; The identification module is used to score the attack feasibility of the multiple attack paths, include high-risk attack paths that meet the preset high feasibility conditions into the calculation pool, and calculate the occurrence number of attack links of all high-risk attack paths in the calculation pool. Based on the occurrence number, the target attack path that meets the preset maximum attack link condition is determined.
8. A vehicle, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the method for identifying the attack path of a vehicle as described in any one of claims 1-6.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the method for identifying the attack path of a vehicle as described in any one of claims 1-6.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed, it is used to implement the method for identifying the attack path of a vehicle as described in any one of claims 1-6.