Virus processing method, device and system and storage medium
By comparing vehicle software image data with virus template libraries, the source of the virus was identified and actively attacked, solving the problem of virus spread and improving vehicle network security, especially the ability to identify and handle unknown viruses.
Patent Information
- Application Number
- CN202511902043.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-17
- Publication Date
- 2026-03-17
AI Technical Summary
Existing vehicle network security protection measures are unable to effectively block the source of viruses when facing virus attacks, resulting in a wide spread of viruses and insufficient ability to identify and deal with unknown viruses.
By receiving vehicle software image data and comparing it with a virus template library, the system determines whether a virus exists; it simulates the environment of unknown viruses to obtain characteristic information; it actively attacks the virus source server to block the propagation path and updates the virus template library to identify and prevent unknown viruses.
It effectively blocks the transmission path of viruses, reduces the scope of harm, improves the ability to identify and deal with unknown viruses, enables the system to learn and adapt itself, and enhances network security.
Smart Images
Figure CN121690759A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of vehicle network security technology, and in particular to a virus processing method, apparatus, system and storage medium. Background Technology
[0002] With the rapid development of vehicle-to-everything (V2X) technology, vehicles are interacting with the outside world more frequently, which exposes them to an increasing number of cybersecurity threats. Among these, virus attacks are a common and particularly damaging form of threat.
[0003] Currently, there are still shortcomings in vehicle network security protection. For example, after a vehicle is confirmed to have been attacked by a virus, the existing handling methods are often rather passive, usually only involving simply isolating the infected device or removing known viruses, without effectively blocking the source of the virus. The source server may continue to spread the virus to other vehicles, causing a large-scale spread of the virus and further expanding the scope of harm.
[0004] Therefore, providing a virus processing method to reduce the scope of virus harm and improve network security is a technical problem that urgently needs to be solved. Summary of the Invention
[0005] This application provides a virus processing method, apparatus, system, and storage medium to reduce the scope of virus harm and improve network security.
[0006] This application provides a virus processing method, including: When vehicle software image data is received, the vehicle software image data is compared with the virus template library; When the comparison results are inconsistent, determine whether there is a virus in the vehicle software image data; When a virus is present, proactive countermeasures are taken to attack the source server of the virus in order to block the source of virus transmission. When the virus is an unknown virus, obtain the characteristic information of the unknown virus; The virus template library is updated based on the characteristic information of the unknown virus.
[0007] The beneficial effects of this application are as follows: When a virus is detected, the system takes an active countermeasure approach to attack the virus source server, effectively blocking the virus's propagation path, preventing the large-scale spread of the virus, thereby reducing the scope of the virus's harm and improving network security; secondly, for unknown viruses, by acquiring their characteristic information and updating the virus template library, the system can continuously learn and adapt to new virus variants, improving its ability to identify and handle unknown viruses.
[0008] In one embodiment, determining whether a virus exists in the vehicle software image data includes: The vehicle software image data is compared with the virus template library; When the comparison results are consistent, it is determined that a virus exists in the vehicle software image data, and the virus is a known virus.
[0009] In one embodiment, determining whether a virus exists in the vehicle software image data further includes: The vehicle software image data is compared with the virus template library; When the comparison results are inconsistent, preset index analysis is performed using vehicle software mirror data. The analysis results will determine whether there are any unknown viruses in the vehicle software image data.
[0010] In one embodiment, obtaining the characteristic information of the unknown virus includes: The unknown virus is run in a simulated environment, wherein the simulated environment is identical to the software environment of an actual vehicle; When the unknown virus runs in a simulated environment, at least one of the following characteristics is obtained: code characteristics, network communication characteristics, behavioral characteristics, and degree of impact of the unknown virus.
[0011] The beneficial effect of this embodiment is that by running an unknown virus in a simulated environment, it is possible to comprehensively obtain its various characteristic information, which provides strong support for subsequent virus processing and prevention.
[0012] In one embodiment, obtaining at least one of the following characteristic information of the unknown virus: code characteristics, network communication characteristics, behavioral characteristics, and degree of impact includes: To reverse engineer the code of an unknown virus in order to obtain its code characteristics. Analyze the behavior of location-based viruses in network communication to obtain the network communication characteristics of unknown viruses; By capturing network data packets of the virus using packet capture tools and parsing the content of the data packets, the behavioral characteristics of the unknown virus can be determined. These behavioral characteristics include the propagation method, attack method, and interaction method with the attacker. The extent of the impact of the unknown virus was assessed.
[0013] The beneficial effects of this embodiment are as follows: by reverse engineering the unknown virus code and analyzing network communication behavior, we can deeply analyze the nature and working principle of the virus, providing a more accurate basis for virus handling; by assessing the degree of virus impact, we can accurately understand the specific harm of the virus to device performance, data security and stability, providing an important reference for formulating handling strategies.
[0014] In one embodiment, updating the virus template library based on the characteristic information of the unknown virus includes: Create a new template in the virus template library; Fill in the characteristic information of the unknown virus in the new template; The new templates are classified according to the degree of impact of the unknown virus, and an index structure corresponding to the new templates is established.
[0015] The beneficial effects of this embodiment are as follows: by updating the virus template library, the system's ability to identify known viruses can be improved, while its ability to predict and prevent unknown viruses can be enhanced. After establishing the index structure of the new templates, similar virus variants can be quickly located and identified, improving the efficiency and accuracy of virus processing.
[0016] In one embodiment, the proactive attack on the source server of the virus includes: Identify the source server of the virus; The vehicle-to-everything (V2X) platform sends instructions to the adversary vehicles that have already deployed defense strategies, enabling the adversary vehicles to reverse-engineer the virus source server and paralyze the source server.
[0017] The beneficial effect of this embodiment is that by identifying the source server of the virus and taking proactive countermeasures, the source of virus transmission can be accurately targeted, effectively curbing the spread and harm of the virus.
[0018] This application also provides a virus processing device, comprising: The comparison module is used to compare the vehicle software image data with a virus template library when the vehicle software image data is received. The judgment module is used to determine whether a virus exists in the vehicle software image data when the comparison results are inconsistent. The attack module is used to proactively attack the source server of a virus when it exists, in order to block the source of virus transmission. The acquisition module is used to acquire the characteristic information of the unknown virus when the virus is an unknown virus; The update module is used to update the virus template library based on the characteristic information of the unknown virus.
[0019] In one embodiment, the determining module includes: The first comparison submodule is used to compare the vehicle software image data with the virus template library; The determination submodule is used to determine, when the comparison results are consistent, that a virus exists in the vehicle software image data, and that the virus is a known virus.
[0020] In one embodiment, the determining module further includes: The second comparison submodule is used to compare the vehicle software image data with the virus template library; The analysis submodule is used to perform preset index analysis using vehicle software mirror data when the comparison results are inconsistent. The judgment submodule is used to determine whether there are unknown viruses in the vehicle software image data based on the analysis results.
[0021] In one embodiment, the acquisition module includes: The runtime submodule is used to run the unknown virus in a simulated environment, wherein the simulated environment is the same as the software environment of an actual vehicle; The acquisition submodule is used to acquire at least one of the following characteristic information of the unknown virus when the unknown virus is running in a simulated environment: code characteristics, network communication characteristics, behavioral characteristics, and degree of impact.
[0022] In one embodiment, the acquisition submodule includes: To reverse engineer the code of an unknown virus in order to obtain its code characteristics. Analyze the behavior of location-based viruses in network communication to obtain the network communication characteristics of unknown viruses; By capturing network data packets of the virus using packet capture tools and parsing the content of the data packets, the behavioral characteristics of the unknown virus can be determined. These behavioral characteristics include the propagation method, attack method, and interaction method with the attacker. The extent of the impact of the unknown virus was assessed.
[0023] In one embodiment, the updating module includes: Create a submodule to create new templates in the virus template library; The fill-in submodule is used to fill in the characteristic information of the unknown virus in the new template; The classification submodule is used to classify the new template according to the degree of impact of the unknown virus and to establish an index structure corresponding to the new template.
[0024] In one embodiment, the attack module includes: The identification submodule is used to identify the source server of the virus; The sending submodule is used to send instructions to the adversarial vehicles with deployed defense strategies through the vehicle networking platform, so that the adversarial vehicles can reverse-engineer the attack virus that paralyzes the source server.
[0025] This application also provides a virus handling system, including: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to implement the virus processing method described in any of the above embodiments.
[0026] This application also provides a computer-readable storage medium, which, when the instructions in the storage medium are executed by a processor corresponding to a virus processing system, enables the virus processing system to implement the virus processing method described in any of the above embodiments.
[0027] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings.
[0028] The technical solution of this application will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0029] The accompanying drawings are provided to further illustrate the present application and form part of the specification. They are used together with the embodiments of the present application to explain the application and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a virus processing method according to an embodiment of this application; Figure 2 This is a block diagram of a virus processing device according to an embodiment of this application; Figure 3 This is a schematic diagram of the hardware structure of a virus processing system according to one embodiment of this application. Detailed Implementation
[0030] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application.
[0031] Figure 1 This is a flowchart of a virus processing method according to an embodiment of this application, such as... Figure 1 As shown, the method can be implemented as follows: S101-S105: In step S101, when vehicle software image data is received, the vehicle software image data is compared with the virus template library; In step S102, when the comparison results are inconsistent, it is determined whether there is a virus in the vehicle software image data; In step S103, when a virus is present, an active countermeasure is taken to attack the source server of the virus in order to block the source of virus transmission. In step S104, when the virus is an unknown virus, the characteristic information of the unknown virus is obtained; In step S105, the virus template library is updated based on the characteristic information of the unknown virus.
[0032] In this application, when vehicle software image data is received, the vehicle software image data is compared with a virus template library. Specifically, first vehicle data sent from the mobile terminal can be received, and second vehicle data transmitted from the vehicle terminal's TBOX at the same time can be received. The first vehicle data and the second vehicle data are compared. During the comparison, the first vehicle data and the second vehicle data are timestamped to ensure that the data being compared is from the same time. A data verification mechanism is set up to initially check the integrity and validity of the data, such as whether the data packets are complete, whether there are duplicates or missing data, etc. An exact matching algorithm (such as a hash algorithm) can be used to compare the first vehicle data and the second vehicle data item by item.
[0033] When the comparison results are inconsistent, a request to upload vehicle software image data is sent to the vehicle or mobile phone. Upon receiving the vehicle software image data, it is compared with a virus template library. The virus template library is a pre-built database containing characteristic information of known viruses, such as virus signatures, behavioral patterns, and network communication characteristics. When comparing the vehicle software image data with the virus template library, techniques such as hash algorithms and signature-based matching can be used to compare the received vehicle software image data with the characteristics of known viruses in the virus template library.
[0034] When the comparison results are inconsistent, it is determined whether there is a virus in the vehicle software image data. Specifically, if the comparison results are inconsistent, that is, no known virus characteristics are directly matched, the data security is not immediately determined. Instead, preset indicator analysis is performed on the vehicle software image data. Based on the analysis results, it is determined whether there is an unknown virus in the vehicle software image data.
[0035] When a virus is present, a proactive countermeasure is taken to attack the source server of the virus in order to block the source of virus transmission. Specifically, the source server of the virus is identified; instructions are sent to the countermeasure vehicles with deployed defense strategies through the vehicle network platform so that the countermeasure vehicles can reverse-engineer the attack virus that paralyzes the source server.
[0036] When the virus is an unknown virus, the following steps are taken: First, acquire the characteristic information of the unknown virus. Second, run the unknown virus in a simulated environment, where the simulated environment is identical to the software environment of an actual vehicle. Third, when the unknown virus runs in the simulated environment, acquire at least one of the following characteristic information: code characteristics, network communication characteristics, behavioral characteristics, and degree of impact. Specifically, reverse engineering can be performed on the unknown virus's code to obtain its code characteristics. Fourth, analyze the virus's behavior in network communication to obtain its network communication characteristics. Fifth, capture the virus's network data packets using a packet capture tool, parse the content of the data packets to determine the unknown virus's behavioral characteristics, including its propagation method, attack method, and interaction method with the attacker. Finally, assess the degree of impact of the unknown virus.
[0037] The virus template library is updated based on the characteristic information of the unknown virus. Specifically, a new template is created in the virus template library; the characteristic information of the unknown virus is filled in the new template; the new template is classified according to the degree of influence of the unknown virus, and an index structure corresponding to the new template is established.
[0038] The beneficial effects of this application are as follows: When a virus is detected, the system takes an active countermeasure approach to attack the virus source server, effectively blocking the virus's propagation path, preventing the large-scale spread of the virus, thereby reducing the scope of the virus's harm and improving network security; secondly, for unknown viruses, by acquiring their characteristic information and updating the virus template library, the system can continuously learn and adapt to new virus variants, improving its ability to identify and handle unknown viruses.
[0039] In one embodiment, determining whether a virus exists in the vehicle software image data in step S102 above can be implemented as the following steps A1-A2: In step A1, the vehicle software image data is compared with the virus template library; In step A2, when the comparison results are consistent, it is determined that a virus exists in the vehicle software image data, and the virus is a known virus.
[0040] In one embodiment, determining whether a virus exists in the vehicle software image data in step S102 above can be implemented by the following steps: In step B1, the vehicle software image data is compared with the virus template library; In step B2, when the comparison results are inconsistent, preset index analysis is performed using vehicle software mirror data; In step B3, the analysis results are used to determine whether there is an unknown virus in the vehicle software image data.
[0041] In one embodiment, step S104 above can be implemented as the following steps C1-C2: In step C1, the unknown virus is run in a simulation environment, wherein the simulation environment is the same as the software environment of an actual vehicle; In step C2, when the unknown virus is running in a simulated environment, at least one of the following characteristic information is obtained: code characteristics, network communication characteristics, behavioral characteristics, and degree of impact of the unknown virus.
[0042] The beneficial effect of this embodiment is that by running an unknown virus in a simulated environment, it is possible to comprehensively obtain its various characteristic information, which provides strong support for subsequent virus processing and prevention.
[0043] In one embodiment, step C2 above can be implemented as the following steps D1-D4: In step D1, reverse engineering is performed on the code of the unknown virus to obtain its code characteristics. In step D2, the behavior of the location virus in network communication is analyzed to obtain the network communication characteristics of the unknown virus; In step D3, network data packets of the virus are captured using a packet capture tool, and the content of the data packets is parsed to determine the behavioral characteristics of the unknown virus. The behavioral characteristics include the propagation method, attack method, and interaction method with the attacker. In step D4, the extent of the impact of the unknown virus is assessed.
[0044] In this embodiment, when performing reverse engineering analysis on the code of an unknown virus, a disassembler can be used to convert the binary code into assembly code, allowing for further analysis of the code's logical structure and functional implementation. Through code analysis, the core algorithms and hiding mechanisms of the virus can be thoroughly analyzed.
[0045] When assessing the impact of the unknown virus, the performance indicators of the intelligent device before and after the virus runs, such as CPU utilization, memory usage, and disk I / O, are monitored to evaluate the impact of the virus on device performance; it is determined whether the virus steals, tampers with, or destroys data in the device, so as to assess the impact of the virus on data security through the judgment results; and the impact of the virus on device stability is analyzed based on the number of abnormal situations that occur in the device (such as the number of crashes, restarts, etc.).
[0046] The beneficial effects of this embodiment are as follows: by reverse engineering the unknown virus code and analyzing network communication behavior, we can deeply analyze the nature and working principle of the virus, providing a more accurate basis for virus handling; by assessing the degree of virus impact, we can accurately understand the specific harm of the virus to device performance, data security and stability, providing an important reference for formulating handling strategies.
[0047] In one embodiment, step S105 above can be implemented as the following steps E1-E3: In step E1, a new template is created in the virus template library; In step E2, the characteristic information of the unknown virus is filled in the new template; In step E3, the new templates are classified according to the degree of influence of the unknown virus, and an index structure corresponding to the new templates is established.
[0048] The beneficial effects of this embodiment are as follows: by updating the virus template library, the system's ability to identify known viruses can be improved, while its ability to predict and prevent unknown viruses can be enhanced. After establishing the index structure of the new templates, similar virus variants can be quickly located and identified, improving the efficiency and accuracy of virus processing.
[0049] In one embodiment, step S103 above can be implemented as the following steps F1-F2: In step F1, the virus source server is identified; In step F2, instructions are sent through the vehicle-to-everything (V2X) platform to the adversarial vehicle that has been deployed with a defense strategy, so that the adversarial vehicle can reverse-engineer the attack virus that paralyzes the source server.
[0050] The beneficial effect of this embodiment is that by identifying the source server of the virus and taking proactive countermeasures, the source of virus transmission can be accurately targeted, effectively curbing the spread and harm of the virus.
[0051] In this application, the vehicle networking platform can simultaneously receive data from both the collected data and the data from the TBOX, enabling dual-channel data transmission and real-time data comparison. Compared to traditional single-channel data transmission and simple security monitoring, this multi-channel data interaction and real-time verification method can detect data tampering more promptly and accurately, improving data security and integrity.
[0052] Secondly, in this application, when data inconsistency is detected, the data is quickly mirrored and transmitted to the mobile APP via the mobile phone's Bluetooth channel and reported to the vehicle networking platform. This rapid response mechanism can take timely measures in the early stages when data may be tampered with, avoid further losses, and provide more efficient protection for vehicle data security.
[0053] Furthermore, the vehicle-to-everything (V2X) platform is equipped with a virus template library, enabling rapid detection and removal of known viruses. More innovatively, it can identify unknown viruses. This intelligent identification method overcomes the limitations of traditional reliance on fixed signature databases, significantly improving the ability to detect unknown viruses. Automatic template library updates form a closed loop: once the large model identifies an unknown virus, the V2X platform automatically extracts the virus's signature information and updates it to the virus template library. This automatic update mechanism forms a complete and intelligent closed loop for virus prevention and handling, enabling the vehicle system to continuously adapt to new forms of virus attacks and continuously enhance its resistance to various virus attacks.
[0054] Meanwhile, the proactive defense method of finding the source server IP address by countering the virus implanted in the vehicle and then implanting attack viruses in reverse to paralyze the source server is being used for the first time in existing vehicle security technology, providing new ideas and methods for dealing with complex network attacks.
[0055] Therefore, the dual-channel data transmission and verification, rapid response based on dual-channel data comparison, intelligent virus prevention and handling closed loop, and proactive defense strategies in this application are all comprehensive solutions with unique advantages for addressing the problems existing in the field of vehicle data security. In particular, the innovative feature of identifying unknown viruses and automatically updating the template library greatly enhances the vehicle system's ability to respond to unknown viruses, making vehicle data security protection more intelligent and proactive, and effectively improving the security of vehicle data and the system's virus prevention capabilities.
[0056] Figure 2 This is a block diagram of a virus processing device according to an embodiment of the present application, comprising: The comparison module 201 is used to compare the vehicle software image data with the virus template library when the vehicle software image data is received. The judgment module 202 is used to determine whether a virus exists in the vehicle software image data when the comparison results are inconsistent. Attack module 203 is used to proactively attack the source server of a virus when it is present, in order to block the source of virus transmission. The acquisition module 204 is used to acquire the characteristic information of the unknown virus when the virus is an unknown virus; The update module 205 is used to update the virus template library based on the characteristic information of the unknown virus.
[0057] In one embodiment, the determining module includes: The first comparison submodule is used to compare the vehicle software image data with the virus template library; The determination submodule is used to determine, when the comparison results are consistent, that a virus exists in the vehicle software image data, and that the virus is a known virus.
[0058] In one embodiment, the determining module further includes: The second comparison submodule is used to compare the vehicle software image data with the virus template library; The analysis submodule is used to perform preset index analysis using vehicle software mirror data when the comparison results are inconsistent. The judgment submodule is used to determine whether there are unknown viruses in the vehicle software image data based on the analysis results.
[0059] In one embodiment, the acquisition module includes: The runtime submodule is used to run the unknown virus in a simulated environment, wherein the simulated environment is the same as the software environment of an actual vehicle; The acquisition submodule is used to acquire at least one of the following characteristic information of the unknown virus when the unknown virus is running in a simulated environment: code characteristics, network communication characteristics, behavioral characteristics, and degree of impact.
[0060] In one embodiment, the acquisition submodule includes: To reverse engineer the code of an unknown virus in order to obtain its code characteristics. Analyze the behavior of location-based viruses in network communication to obtain the network communication characteristics of unknown viruses; By capturing network data packets of the virus using packet capture tools and parsing the content of the data packets, the behavioral characteristics of the unknown virus can be determined. These behavioral characteristics include the propagation method, attack method, and interaction method with the attacker. The extent of the impact of the unknown virus was assessed.
[0061] In one embodiment, the updating module includes: Create a submodule to create new templates in the virus template library; The fill-in submodule is used to fill in the characteristic information of the unknown virus in the new template; The classification submodule is used to classify the new template according to the degree of impact of the unknown virus and to establish an index structure corresponding to the new template.
[0062] In one embodiment, the attack module includes: The identification submodule is used to identify the source server of the virus; The sending submodule is used to send instructions to the adversarial vehicles with deployed defense strategies through the vehicle networking platform, so that the adversarial vehicles can reverse-engineer the attack virus that paralyzes the source server.
[0063] This application also provides a virus handling system, including: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to implement the virus processing method described in any of the above embodiments.
[0064] Figure 3 This is a schematic diagram of the hardware structure of a virus processing system according to one embodiment of this application, as shown below. Figure 3 As shown, the virus processing system includes: At least one processor 320; and, Memory 304 communicatively connected to the at least one processor 320; wherein, The memory 304 stores instructions that can be executed by the at least one processor 320 to implement the virus treatment method described in any of the above embodiments.
[0065] Reference Figure 3 The virus processing system 300 may include one or more of the following components: processing component 302, memory 304, power supply component 306, input / output (I / O) interface 308, sensor component 310, and communication component 312.
[0066] Processing component 302 typically controls the overall operation of virus processing system 300. Processing component 302 may include one or more processors 320 to execute instructions to complete all or part of the steps of the methods described above. Furthermore, processing component 302 may include one or more modules to facilitate interaction between processing component 302 and other components. The processor 320 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.
[0067] Memory 304 is configured to store various types of data to support the operation of virus processing system 300. Examples of this data include instructions for any application or method operating on virus processing system 300. Memory 304 may be an internal storage unit of the terminal device, such as the hard disk or memory of the terminal device. Memory 304 may also be an external storage device of the terminal device, such as a plug-in hard disk equipped on the terminal device. Memory 304 may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. Memory 304 is used to store programs and data required by this application. Memory 304 may also be used to temporarily store data that has been output or will be output.
[0068] Power supply component 306 provides power to various components of the virus processing system 300. Power supply component 306 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the virus processing system 300.
[0069] I / O interface 308 provides an interface between processing component 302 and peripheral interface modules, such as keyboards, click wheels, buttons, etc.
[0070] Sensor assembly 310 includes one or more sensors for providing status assessments of various aspects of the virus processing system 300. Additionally, sensor assembly 310 can detect the on / off state of the virus processing system 300, the relative positioning of components, and the operational status of the virus processing system 300 or a component of the virus processing system 300. In some embodiments, sensor assembly 310 may include an accelerometer, gyroscope, magnetometer, pressure sensor, or temperature sensor, etc.
[0071] Communication component 312 is configured to enable virus processing system 300 to provide wired or wireless communication capabilities with other devices and cloud platforms. Virus processing system 300 can access wireless networks based on communication standards, such as WiFi, 2G, or 3G, or combinations thereof. In one exemplary embodiment, communication component 316 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 316 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.
[0072] In an exemplary embodiment, the virus processing system 300 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the virus processing method described in any of the above embodiments.
[0073] This application also provides a computer-readable storage medium, which, when the instructions in the storage medium are executed by a processor corresponding to a virus processing system, enables the virus processing system to implement the virus processing method described in any of the above embodiments.
[0074] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.
[0075] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0076] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0077] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0078] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.
Claims
1. A method of virus treatment, characterized by, The method comprises the steps of: When receiving vehicle software image data, comparing the vehicle software image data with a virus template library; When the comparison result is inconsistent, determining whether there is a virus in the vehicle software image data; When there is a virus, attacking the source server of the virus in an active confrontation mode to block the source of virus propagation; When the virus is an unknown virus, obtaining characteristic information of the unknown virus; Updating the virus template library according to the characteristic information of the unknown virus.
2. The method of claim 1, wherein, The step of determining whether there is a virus in the vehicle software image data comprises the steps of: Comparing the vehicle software image data with the virus template library; When the comparison result is consistent, determining that there is a virus in the vehicle software image data, and the virus is a known virus.
3. The method of claim 1, wherein, The step of determining whether there is a virus in the vehicle software image data further comprises the steps of: Comparing the vehicle software image data with the virus template library; When the comparison result is inconsistent, performing preset index analysis on the vehicle software image data; According to the analysis result, determining whether there is an unknown virus in the vehicle software image data.
4. The method of claim 1, wherein, The step of obtaining the characteristic information of the unknown virus comprises the steps of: Running the unknown virus in a simulation environment, wherein the simulation environment is the same as the software environment of an actual vehicle; When the unknown virus is running in the simulation environment, obtaining at least one of the code characteristics, network communication characteristics, behavior characteristics and influence degree of the unknown virus.
5. The method of claim 4, wherein, The step of obtaining at least one of the code characteristics, network communication characteristics, behavior characteristics and influence degree of the unknown virus comprises the steps of: Performing reverse analysis on the code of the unknown virus to obtain the code characteristics of the unknown virus; Analyzing the behavior of the unknown virus in network communication to obtain the network communication characteristics of the unknown virus; Capturing the network data packet of the virus by a packet capture tool, analyzing the content of the data packet to determine the behavior characteristics of the unknown virus, wherein the behavior characteristics include the propagation mode, the attack mode and the interaction mode with the attacker; Evaluating the influence degree of the unknown virus.
6. The method of claim 1, wherein, The step of updating the virus template library according to the characteristic information of the unknown virus comprises the steps of: Creating a new template in the virus template library; Filling in the characteristic information of the unknown virus in the new template; According to the influence degree of the unknown virus, classifying the new template and establishing an index structure corresponding to the new template.
7. The method of claim 1, wherein, The step of attacking the source server of the virus in an active confrontation mode comprises the steps of: Identifying the source server of the virus; Sending an instruction to a confrontation vehicle that has deployed a defense strategy through a vehicle networking platform, so that the confrontation vehicle implants an attack virus that causes the source server to be paralyzed into the source server in a reverse direction.
8. A virus treatment apparatus, characterized by, The method comprises the steps of: A comparison module is configured to compare vehicle software image data with a virus template library when the vehicle software image data is received; A determination module is configured to determine whether there is a virus in the vehicle software image data when the comparison result is inconsistent; An attack module is configured to attack the source server of the virus in an active confrontation mode when there is a virus, so as to block the source of virus propagation; An obtaining module is configured to obtain characteristic information of the unknown virus when the virus is an unknown virus. An updating module is configured to update the virus template library according to the characteristic information of the unknown virus.
9. A viral processing system, characterized by, The virus processing system comprises: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to implement the virus processing method according to any one of claims 1-7.
10. A computer-readable storage medium, characterized in that, When the instructions in the storage medium are executed by the processor corresponding to the virus processing system, the virus processing system can implement the virus processing method according to any one of claims 1-7.