An attack detection method, apparatus, and electronic device

Abstract

This invention provides an attack detection method, apparatus, and electronic device, applied in the field of vehicle network security technology. The invention acquires anchor messages configured with deadlines, collects the number of arbitration failures, queuing time, and actual transmission time during the transmission process, calculates the queuing waiting time, and generates a deadline violation indicator based on the deadline. Multiple transmission samples are aggregated within a specified sliding window, and a fingerprint vector reflecting the bus resource contention status is generated based on the above parameters. This fingerprint vector is compared with a pre-built adaptive baseline to obtain an anomaly score. When the anomaly score exceeds a preset threshold, a disguised high-priority flooding attack is identified. This invention improves the accuracy and robustness of attack detection by monitoring underlying resource contention characteristics and accurately identifying anomalies caused by disguised high-priority attacks.

Description

Technical Field

[0001] This invention relates to the field of vehicle network security technology, and in particular to an attack detection method, device, and electronic device. Background Technology

[0002] The Controller Area Network (CAN) bus uses a bit-based arbitration mechanism, where smaller identifier values ​​indicate higher priority. Attackers can spoof legitimate high-priority messages to launch a flood attack, causing bus resources to be occupied by high-priority messages for extended periods, preventing low-priority messages from being sent in a timely manner, thus leading to control delays and functional failures.

[0003] Existing detection methods are mostly based on statistical characteristics such as message frequency, load rate, or ID (identifier) ​​distribution. They are effective against common flood attacks, but when attackers use legitimate high-priority IDs and send messages at a near-normal pace, the statistical characteristics do not change significantly, making them difficult to detect.

[0004] Therefore, accurately identifying disguised high-priority flood attacks has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of the above problems, the present invention provides an attack detection method, apparatus, and electronic device that overcomes or at least partially solves the above problems, the technical solution of which is as follows:

[0006] An attack detection method, comprising:

[0007] Obtain the anchor message of the controller local area network bus, wherein the anchor message is configured with an anchor expiration period;

[0008] Collect the number of arbitration failures, queuing time, and actual transmission time of each transmission process on the sending side of the anchor point message;

[0009] The queuing time is obtained using the enqueue time and the actual sending time;

[0010] Using the queue waiting time and the anchor point deadline, a deadline violation indication is generated;

[0011] Multiple transmission samples of the anchor point message are aggregated within a specified sliding window, and a resource contention fingerprint vector is generated using the number of arbitration failures, the queuing time, and the deadline violation indication.

[0012] The resource contention fingerprint vector is compared with a pre-built adaptive baseline to obtain the anomaly score of the anchor message;

[0013] If the abnormal score is greater than a preset threshold, it is determined that a disguised high-priority flood attack exists.

[0014] Optionally, obtaining the anchor message of the controller local area network bus includes:

[0015] Obtain low-priority periodic messages sent locally by the gateway on the controller local area network bus or low-priority test messages actively injected by the gateway as anchor messages.

[0016] Optionally, the step of summarizing multiple transmission samples of the anchor message within a specified sliding window, and generating a resource contention fingerprint vector using the number of arbitration failures, the queuing time, and the deadline violation indication, includes:

[0017] Collect a set of samples of successfully sent anchor messages within a specified sliding window;

[0018] Calculate the average number of arbitration failures for all samples in the sample set to obtain the mean arbitration failure rate;

[0019] Calculate the preset quantile of the queuing time for all samples in the sample set to obtain the queuing quantile;

[0020] Using the deadline violation indicator, the proportion of samples in the sample set that have experienced deadline violations is calculated to obtain the deadline violation rate;

[0021] The mean arbitration failure, the queuing waiting quantile, and the deadline violation rate are combined to form a resource competition fingerprint vector.

[0022] Optionally, the process of constructing the adaptive baseline includes:

[0023] Establish a baseline mean and fluctuation scale for each component of the resource contention fingerprint vector of the anchor message;

[0024] Within the specified sliding window, if it is determined that there is no disguised high-priority flooding attack, the baseline mean and the fluctuation scale are updated exponentially; otherwise, the update of the baseline mean and the fluctuation scale is paused.

[0025] Optionally, comparing the resource contention fingerprint vector with a pre-built adaptive baseline to obtain the anomaly score of the anchor message includes:

[0026] Calculate the difference between each component of the resource contention fingerprint vector and the corresponding baseline mean;

[0027] The deviation of each component is obtained by using the difference and the fluctuation scale corresponding to each component;

[0028] The anomaly score of the anchor message is obtained by summing the deviations of all components of the resource contention fingerprint vector.

[0029] Optionally, the method further includes:

[0030] Within the specified sliding window, if an arbitration failure site is captured, the sites where each arbitration failure occurred are counted, and an arbitration failure site histogram is generated based on the statistical results.

[0031] Calculate the degree of difference between the histogram of the arbitration failure sites and the baseline histogram under normal operating conditions.

[0032] Optionally, after determining that a disguised high-priority flooding attack exists, the method further includes:

[0033] Output a fake flood alarm message and trigger the gateway to execute security policies, including limiting the transmission of non-critical messages, enabling whitelist verification for suspicious high-priority message IDs, or triggering a system security degradation mode.

[0034] Optionally, the method further includes:

[0035] When the sending side of the anchor message is not local, the anchor message is configured to report the number of arbitration failures, the queuing time and the number of deadline violations collected through high-priority messages or independent communication channels.

[0036] If no data is received from the anchor point message within the sliding window, an anchor point missing alarm is output.

[0037] An attack detection device includes: an anchor message acquisition unit, a message transmission data acquisition unit, a queuing time acquisition unit, a deadline violation indicator generation unit, a resource contention fingerprint vector generation unit, an anomaly score acquisition unit, and a spoofing flood attack determination unit.

[0038] The anchor message acquisition unit is used to acquire the anchor message of the controller local area network bus, wherein the anchor message is configured with an anchor expiration period.

[0039] The message transmission data acquisition unit is used to collect the number of arbitration failures, queuing time and actual transmission time of each transmission process on the sending side of the anchor message;

[0040] The queuing waiting time acquisition unit is used to obtain the queuing waiting time using the queuing time and the actual sending time;

[0041] The deadline violation indication generation unit is used to generate a deadline violation indication using the queuing waiting time and the anchor point deadline.

[0042] The resource contention fingerprint vector generation unit is used to summarize multiple transmission samples of the anchor message within a specified sliding window, and generate a resource contention fingerprint vector using the number of arbitration failures, the queuing time, and the deadline violation indication.

[0043] The anomaly score acquisition unit is used to compare the resource contention fingerprint vector with a pre-built adaptive baseline to obtain the anomaly score of the anchor message.

[0044] The spoofing flood attack determination unit is used to determine the existence of a spoofing high-priority flood attack when the abnormal score is greater than a preset threshold.

[0045] An electronic device includes at least one processor, at least one memory connected to the processor, and a bus; wherein the processor and the memory communicate with each other via the bus; the processor is used to call program instructions in the memory to execute the attack detection method.

[0046] By employing the above technical solutions, this invention provides an attack detection method, apparatus, and electronic device that obtains anchor packets of a controller area network bus, wherein the anchor packets are configured with anchor deadlines; collects the number of arbitration failures, queuing time, and actual transmission time during each transmission process of the anchor packet's sending side; obtains the queuing time using the queuing time and actual transmission time; generates a deadline violation indicator using the queuing time and anchor deadline; summarizes multiple transmission samples of the anchor packets within a specified sliding window, and generates a resource contention fingerprint vector using the number of arbitration failures, queuing time, and deadline violation indicator; compares the resource contention fingerprint vector with a pre-constructed adaptive baseline to obtain an anomaly score for the anchor packets; and determines the existence of a disguised high-priority flooding attack when the anomaly score exceeds a preset threshold. This invention constructs a fingerprint vector reflecting the bus resource contention status by collecting the number of arbitration failures, queuing time, and deadline violation indicator during the transmission process of the anchor packets, and compares it with an adaptive baseline to accurately capture resource contention anomalies caused by disguised high-priority flooding attacks, thereby achieving accurate identification of this type of attack.

[0047] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0048] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0049] Figure 1 A flowchart illustrating one embodiment of the attack detection method provided by this invention is shown.

[0050] Figure 2 The diagram shows a specific implementation of step S140 in the attack detection method provided by the present invention.

[0051] Figure 3 The diagram shows a specific implementation of step S150 in the attack detection method provided by the present invention.

[0052] Figure 4 This figure shows a schematic diagram of an attack detection device provided in an embodiment of the present invention;

[0053] Figure 5 A schematic diagram of an electronic device provided in an embodiment of the present invention is shown. Detailed Implementation

[0054] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the invention and to fully convey the scope of the invention to those skilled in the art.

[0055] Controller Area Network (CAN) buses are widely used in automotive electronic systems, employing a bit-based arbitration mechanism to determine message transmission priority. The smaller the CAN identifier value, the higher its priority. Under this mechanism, messages with smaller identifiers can preferentially occupy bus resources, ensuring the timely transmission of critical control information. However, this mechanism also provides an opportunity for attackers. Attackers can launch a flood attack by spoofing a legitimate and high-priority CAN identifier, causing the bus to be occupied by high-priority messages for an extended period, preventing low-priority messages from being sent on time. This is known as a high-priority spoofing flood attack. Such attacks not only cause delays in critical control loops but may also lead to lag in state updates or even functional failures, seriously threatening the safety and normal operation of the vehicle.

[0056] Currently, detection methods for CAN bus flooding attacks are mostly based on statistical characteristics such as message frequency, load rate, identifier distribution, or information entropy. These methods are effective in detecting ordinary flooding attacks because the abnormal behavior produced by the attack usually leads to significant changes in statistical characteristics. However, when an attacker selects legitimate high-priority identifiers that already exist on the bus and adjusts the transmission rhythm to a near-normal cycle, these changes in statistical distribution may be very subtle, greatly increasing the risk of missed detections.

[0057] Unlike application-layer detection methods based on message statistical characteristics, the CAN bus arbitration process and transmission queue behavior pertain to underlying resource usage. The continuous congestion of high-priority messages inevitably increases the number of arbitration failures and queuing times for low-priority messages. This side effect of resource contention is difficult for attackers to mask by spoofing message IDs or service fields. Therefore, observing abnormal changes in low-priority messages during arbitration and queuing processes from the side-channel perspective of bus resource contention can effectively identify spoofed high-priority flooding attacks and provide interpretable evidence for alarms, meeting current security protection requirements.

[0058] Based on this, this invention provides an attack detection method. First, by acquiring anchor messages configured with deadlines, the number of arbitration failures, queuing time, and actual transmission time during the transmission process are collected to calculate the queuing waiting time and generate a deadline violation indicator based on the deadline. Second, multiple transmission samples are aggregated within a specified sliding window, and a fingerprint vector reflecting the bus resource contention status is generated based on the above parameters. This fingerprint vector is compared with a pre-built adaptive baseline to obtain an anomaly score. Finally, when the anomaly score exceeds a preset threshold, a disguised high-priority flooding attack is determined to exist. It is evident that this invention, by monitoring the characteristics of underlying resource contention, accurately identifies anomalies caused by disguised high-priority attacks, improving the accuracy and robustness of attack detection.

[0059] like Figure 1 The diagram shows a flowchart of one embodiment of the attack detection method provided by this invention. The method may include:

[0060] S100: Obtain the anchor message of the controller local area network bus, wherein the anchor message is configured with an anchor expiration period.

[0061] The Controller Area Network (CAN) bus, also known as the CAN bus, is mainly used in automotive electronic systems for communication to enable real-time data transmission and resource sharing between controllers.

[0062] Anchor messages refer to a set of selected low-priority and periodically stable CAN messages used as "anchors" to monitor bus resource contention behavior. They can be sent locally by the gateway or monitoring node or actively injected.

[0063] The anchor deadline refers to the strict time limit configured for anchor messages, indicating that the message should be sent within a specific time. Exceeding the time limit is considered a violation of the deadline.

[0064] Specifically, embodiments of the present invention can select multiple low-priority and periodically stable anchor messages from the vehicular network. Each anchor message is pre-configured with a transmission period and a deadline parameter to ensure that subsequent monitoring of message transmission delays has a clear time reference, facilitating accurate detection of resource contention anomalies.

[0065] As examples, we first select M (dimensionless, positive integers, e.g., M=5) low-priority, periodically stable messages from the bus as monitoring anchors, thus obtaining the anchor set. For each selected anchor point message Two key parameters need to be configured for it: sending period (Unit: seconds, value range depends on business configuration) and anchor point deadline (Unit: seconds, value range can be [0.001, 0.5]). The deadline defines the maximum allowed waiting time from when the message enters the sending queue to when it is successfully sent, and is the core benchmark for subsequent judgment of whether it has been abnormally delayed.

[0066] S110. Collect the number of arbitration failures, queuing time, and actual sending time of each transmission process on the sending side of the anchor point message.

[0067] The sending side refers to the sending end of the anchor message, which can be a gateway or a specific ECU (Electronic Control Unit) used for data acquisition from queuing to actual transmission.

[0068] Among them, the number of arbitration failures refers to the number of times the CAN controller fails in bus arbitration when sending anchor messages, reflecting the resource contention situation, and is taken from the controller counter register or driver layer statistics.

[0069] The enqueue time refers to the time when the anchor message enters the sending queue, indicating that the message is ready to be sent.

[0070] The actual transmission time refers to the time when the anchor message actually begins to be transmitted on the bus, indicating the start of message transmission.

[0071] Specifically, in this embodiment of the invention, the enqueue time of each anchor message entering the transmission queue and the actual time when the message starts to be transmitted on the bus can be recorded in real time at the sending end of the anchor message. At the same time, the number of arbitration failures that occurred during the transmission of the frame can be obtained from the CAN controller or driver layer to ensure that the resource contention situation during message transmission can be fully reflected.

[0072] As some examples, when anchor messages When the k-th sending request enters the sending queue, its enqueue time is recorded. When the message finally gains bus arbitration and begins physical transmission (e.g., when the start of an SOF frame is detected), its actual transmission time is recorded. Simultaneously, the number of arbitration failures experienced during the waiting process of this transmission attempt is obtained from the arbitration failure count register of the CAN controller or through statistics from the driver layer. The value range is non-negative integers.

[0073] S120. Calculate the queuing time using the enqueue time and the actual sending time.

[0074] Queuing time refers to the interval between the enqueue time and the actual sending time, indicating the length of time a message waits in the sending queue.

[0075] Specifically, in this embodiment of the invention, the queuing time of the anchor message can be obtained by calculating the difference between the actual sending time and the enqueue time for each transmission. The queuing time reflects the delay caused by bus resource contention in the transmission queue and is an important characteristic for judging resource contention.

[0076] As some examples, embodiments of the present invention regarding anchor points The queuing time for the k-th transmission. It is obtained by subtracting the enqueue time from the actual sending time, i.e. This time quantifies the total time a message spends in the transmission queue waiting for the bus to become idle and participating in arbitration contention, and is the most direct indicator of the intensity of bus resource contention.

[0077] S130. Utilize queuing time and anchor deadline to generate deadline violation indicators.

[0078] The deadline violation indicator is a binary flag used to indicate whether the queuing time of anchor messages has exceeded their deadline. 0 indicates no violation, and 1 indicates a violation.

[0079] Specifically, in this embodiment of the invention, the calculated queuing waiting time can be compared with the deadline of the corresponding anchor message. If the queuing waiting time is greater than the deadline, the deadline violation indicator is marked as 1; otherwise, it is marked as 0, indicating whether the frame transmission has timed out, thus assisting in the detection of potential resource contention anomalies.

[0080] As some examples, embodiments of the present invention can calculate the queuing waiting time. With the pre-configured deadline for this anchor point (Unit: seconds, value range can be [0.001, 0.5]) for comparison. If the waiting time... Exceeded the deadline Then the deadline violation indicator will be generated. This indicates that the transmission experienced an unacceptable delay; otherwise... This indicator transforms the phenomenon of low-priority anchors being abnormally overcrowded into a clear, statistically significant Boolean event.

[0081] S140. Summarize multiple transmission samples of anchor point messages within a specified sliding window, and generate a resource contention fingerprint vector using the number of arbitration failures, queuing time, and deadline violation of the instruction.

[0082] Among them, the multiple transmission samples of anchor messages refer to the statistical sample set of the multiple transmission processes of anchor messages within a specified sliding time window, which is used for comprehensive analysis of resource competition.

[0083] Among them, the resource contention fingerprint vector refers to a combination vector of one or more indicators used to characterize the bus resource contention status, based on the number of arbitration failures, queuing time, and deadline violation indications.

[0084] Specifically, in this embodiment of the invention, multiple transmission samples of the anchor point message can be collected within a preset time sliding window, the mean number of arbitration failures, the high quantile of queuing time, and the deadline violation rate can be calculated, and these three statistical indicators can be combined into a multi-dimensional resource contention fingerprint vector to comprehensively reflect the bus resource usage status within the current window.

[0085] As examples, embodiments of the present invention define a fixed time length. sliding window (e.g., 0.5 seconds, to avoid anchor messages) In the window Number of samples within This results in a denominator of 0, which is acceptable under normal operating conditions when the configured window length meets the requirements. This ensures that each anchor point successfully sends a sample at least once within a window. Within each window, for each anchor point's message... We collect a set of all successfully sent samples. Based on this set, we calculate three core statistics, which together constitute the resource contention fingerprint vector of this anchor point in the current window. ,in, The average number of arbitration failures, reflecting the average intensity of competition; p-quantiles of queuing wait times that reflect the severity of delays and are sensitive to outliers; The deadline violation rate reflects the frequency of abnormal delay events. These three dimensions in the resource contention fingerprint vector collectively characterize the overall situation of bus resource contention within that time period. If no successfully transmitted samples are sent to the anchor point within the window, an "anchor point missing" alarm is triggered directly.

[0086] S150. Compare the resource contention fingerprint vector with the pre-built adaptive baseline to obtain the anomaly score of the anchor message.

[0087] The adaptive baseline refers to the mean and fluctuation range of the anchor message resource competition characteristics established under normal operating conditions through exponential sliding updates, serving as a reference standard for anomaly detection.

[0088] The anomaly score refers to the quantified value of the deviation calculated after comparing the resource contention fingerprint vector with the adaptive baseline, which is used to determine whether there is abnormal resource contention behavior.

[0089] Specifically, in this embodiment of the invention, the fingerprint vector can be compared with the dynamically updated adaptive baseline mean and fluctuation scale under normal operating conditions to calculate and normalize the deviations in each dimension, thereby obtaining the anomaly score of the anchor message. A high anomaly score indicates that the current resource competition situation deviates significantly from the normal level, suggesting the possible existence of attack behavior.

[0090] As examples, embodiments of the present invention establish a baseline mean for each component (i.e., mean, quantile, and violation rate) of the fingerprint vector for each anchor point under initial normal operating conditions. and fluctuation scale During operation, for windows deemed normal, these baseline parameters are updated using an exponential moving average method to adapt to slow changes in operating conditions. For the fingerprint vector of the current window... Calculate the deviation of each component from the corresponding baseline mean, and normalize the deviation by dividing it by its fluctuation scale (adding a small constant to prevent division by zero) to obtain the deviation degree of each component. Sum the deviation degrees of all components (or take the maximum value) to obtain the anomaly score of the anchor point in the current window. The higher the score, the greater the deviation of the current resource competition pattern from the normal baseline.

[0091] S160. If the abnormal score is greater than the preset threshold, it is determined that there is a disguised high-priority flood attack.

[0092] The preset threshold refers to the threshold for judging abnormal scores. If the score is exceeded, an abnormal alarm will be triggered. The threshold can be flexibly configured according to working conditions and safety requirements.

[0093] Specifically, in this embodiment of the invention, when the abnormal score of the anchor message exceeds a pre-configured threshold, it can be determined that a spoofed high-priority flooding attack has occurred. That is, the attacker causes the bus resources to be squeezed by spoofing high-priority messages, thereby triggering an alarm and driving defense strategies such as rate limiting and isolation to ensure network security and stability.

[0094] As some examples, embodiments of the present invention can calculate the maximum value among the anomaly scores of all anchor messages as the total anomaly score. Compare this score with a preset global alarm threshold. (As in 6) make a comparison. If If the bus is detected as having a fake high-priority flood attack, then the output is considered normal; otherwise, the output is normal.

[0095] This invention provides an attack detection method, which includes: obtaining anchor packets of a controller area network bus, wherein the anchor packets are configured with anchor deadlines; collecting the number of arbitration failures, queuing time, and actual transmission time during each transmission process of the anchor packets from the sending side; obtaining the queuing time using the queuing time and actual transmission time; generating a deadline violation indicator using the queuing time and anchor deadline; summarizing multiple transmission samples of anchor packets within a specified sliding window, and generating a resource contention fingerprint vector using the number of arbitration failures, queuing time, and deadline violation indicator; comparing the resource contention fingerprint vector with a pre-constructed adaptive baseline to obtain an anomaly score for the anchor packets; and determining that a disguised high-priority flooding attack exists if the anomaly score is greater than a preset threshold. This invention constructs a fingerprint vector reflecting the bus resource contention status by collecting the number of arbitration failures, queuing time, and deadline violation indicator during the transmission process of anchor packets, and compares it with an adaptive baseline to accurately capture resource contention anomalies caused by disguised high-priority flooding attacks, thereby achieving accurate identification of this type of attack.

[0096] Optionally, in the above Figure 1 Based on one or more corresponding embodiments, in another optional embodiment provided by the present invention, step S100 may specifically include:

[0097] Obtain low-priority periodic messages sent locally by the gateway on the controller local area network bus or low-priority test messages actively injected by the gateway as anchor messages.

[0098] Specifically, in this embodiment of the invention, the message sent by the security gateway itself or the low-priority test message (with a large ID, such as 0x6F0, 0x6F1, 0x6F2, 0x6F3 and 0x6F4) actively injected by the gateway can be selected first to ensure that the observation data can be directly obtained by the gateway locally, and to avoid delays or loss of remote data reporting due to bus congestion.

[0099] Optional, based on Figure 1 The method shown is as follows: Figure 2 The diagram shows a specific implementation of step S140 in the attack detection method provided by this invention. Step S140 may specifically include:

[0100] S200. Collect a set of samples of successfully sent anchor point messages within a specified sliding window.

[0101] Specifically, in this embodiment of the invention, a preset sliding window length can be used as a time interval to continuously monitor and collect all successfully sent samples within the time window, including the queuing time, actual sending time, number of arbitration failures, and deadline violation amount for each transmission, to ensure that the sample set can represent the resource contention status within the window.

[0102] As examples, embodiments of the present invention may set a sliding window with a fixed time length of 0.5 seconds. And continue to slide (e.g., slide once every 100 milliseconds). For each anchor message In the window Within this process, it iterates through all transmission events and filters out those samples that successfully completed the physical transmission. Each successful transmission sample k contains the number of arbitration failures recorded during that transmission. Queueing time and deadline violation of the order quantity The set of these successful samples forms the anchor point. In the window The observation dataset within The sample size is denoted as ,in, This is a cardinality function for sets, outputting the number of elements in the set. If... This means that the anchor point is in the window. If the fingerprint fails to be sent successfully, this situation is directly judged as a serious anomaly of "anchor point missing" and an alarm is triggered. At the same time, the fingerprint calculation of the anchor point is skipped.

[0103] S210. Calculate the average number of arbitration failures for all samples in the sample set to obtain the mean arbitration failure.

[0104] Specifically, in this embodiment of the invention, the number of arbitration failures for all samples within the sliding window can be summed and divided by the number of samples to obtain the mean number of arbitration failures. This mean reflects the arbitration conflict caused by bus resource contention within the time window.

[0105] As examples, embodiments of the present invention obtain a window Inner anchor point Successful sample set Then, the number of arbitration failures for all sample records in this set. Summation is performed, then divided by the total number of samples. Calculate the average number of arbitration failures. The calculation formula is as follows: Average number of arbitration failures It reflects the average number of arbitration failures required for a low-priority anchor message to succeed in sending within the current time window, and is a direct quantitative indicator of the average intensity of bus arbitration contention.

[0106] S220. Calculate the preset quantile of the queuing time for all samples in the sample set to obtain the queuing quantile.

[0107] Specifically, in this embodiment of the invention, all queuing time samples within the sliding window can be sorted by size, and a preset high quantile can be taken as the statistical indicator of queuing time to reflect more serious delays and enhance the sensitivity to abnormal waiting.

[0108] As examples, embodiments of the present invention address windows. Inner anchor point Queuing time for all successful samples The dataset Sort the data. Based on the preset quantile parameter p (dimensionless, with a value range of [0.8, 0.99]), calculate and retrieve the data that is ranked in the order of quantile p. The position (or the value calculated by interpolation) is used as the quantile for waiting in the queue. This quantile (e.g., the 90th percentile) reflects that within the window, at least p percent (e.g., 90%) of the sending wait times at this anchor point are below this value. It can effectively capture abnormal, excessively long queuing delays, while being insensitive to occasional normal small fluctuations, thus more robustly indicating the severity of resource hogging.

[0109] S230. Using the deadline violation indicator, calculate the proportion of samples in the sample set that have a deadline violation, and obtain the deadline violation rate.

[0110] Specifically, in this embodiment of the invention, the number of samples with a deadline violation indicator of 1 in all samples within the sliding window can be counted. The proportion of these samples to the total number of samples is the deadline violation rate, which reflects the severity of timeouts during that time period.

[0111] As some examples, embodiments of the present invention can traverse sliding windows. Inner anchor point All successful samples, for each sample, violate the indication at the deadline. Perform a summation. This summation result represents the number of times a deadline violation occurred within the window (i.e., the waiting time exceeded the preset deadline). The total number of samples. Then, divide this sum by the total number of successful samples within the window. Obtain the deadline violation rate This ratio quantifies the frequency of "unacceptable delay" events. It rises significantly when an attack causes persistent bus congestion, providing another dimension of anomalous evidence from the perspective of event frequency.

[0112] S240. Combine the mean of arbitration failures, the queuing quantile, and the deadline violation rate into a resource competition fingerprint vector.

[0113] Specifically, in this embodiment of the invention, the average arbitration failure, the queuing waiting quantile, and the deadline violation rate can be combined into a multi-dimensional vector form of a resource contention fingerprint vector to reflect the resource contention characteristics of anchor messages within the current sliding window, serving as the basic data for subsequent anomaly detection.

[0114] As some examples, embodiments of the present invention can calculate the average arbitration failure rate separately. Queuing for quantiles and deadline violation rate After taking these three statistics, they are combined in a fixed order into a multidimensional vector, i.e., the anchor point. In the window Internal resource contention fingerprint vector Specifically, it is expressed as: The resource contention fingerprint vector comprehensively and quantitatively characterizes the bus resource contention situation experienced by the anchor message within the current time window from three complementary dimensions: contention intensity (mean), latency severity (quantile), and abnormal event frequency (violation rate).

[0115] This invention, through a comprehensive collection of the number of arbitration failures, queuing time, and deadline violation indicators of anchor point messages within a specified sliding window, calculates their mean, high quantile, and violation rate, and integrates these statistical indicators into a resource contention fingerprint vector. This approach can more comprehensively and accurately reflect the actual state of bus resource contention, improve the sensitivity and robustness of detection against spoofed high-priority flooding attacks, and thus effectively enhance the accuracy of abnormal behavior identification and the system's security protection capabilities.

[0116] Optionally, in the above Figure 1 Based on one or more corresponding embodiments, in another optional embodiment provided by the present invention, the adaptive baseline construction process provided by the present invention may include:

[0117] For each component of the resource contention fingerprint vector of the anchor message, establish a baseline mean and fluctuation scale; within a specified sliding window, if it is determined that there is no spoofed high-priority flooding attack, update the baseline mean and fluctuation scale through exponential sliding; otherwise, pause the update of the baseline mean and fluctuation scale.

[0118] Specifically, in this embodiment of the invention, for each anchor message, a baseline mean and fluctuation scale can be maintained for each component of its resource contention fingerprint vector (such as the mean of arbitration failure, the queuing waiting quantile, and the deadline violation rate). By continuously statistically analyzing and initializing under normal operating conditions, historical benchmark features for each component are formed for reference in subsequent anomaly detection.

[0119] As some examples, embodiments of the present invention can establish two core baseline parameters for the normal behavior of the three components in the resource contention fingerprint vector—the mean of arbitration failures, the queuing quantile, and the deadline violation rate—during the system initialization or learning phase: 1. Baseline mean 1. Represents the long-term average level of this component under historical normal operating conditions; 2. Fluctuation scale This represents the typical range of variation for the component within the normal fluctuation range, used for subsequent normalization of outlier scores. In the initial stage, by collecting data under normal operating conditions (such as vehicle idling or constant speed driving) that is assured to be free of attack, the initial mean and standard deviation (or mean absolute deviation) of each component are calculated as the baseline mean. and fluctuation scale The initial value provides a starting point for subsequent online adaptive updates.

[0120] Furthermore, in this embodiment of the invention, when a new sliding window ends, if the anomaly score of the current window does not exceed the detection threshold and there are no anomalies such as missing anchor points, it indicates that the current window is in normal operating condition. In this case, an exponential moving average method is used to adaptively update the baseline mean and fluctuation scale of each component, allowing the baseline to gradually adapt to small changes in the controller area network bus operating environment, thus improving the accuracy and robustness of detection. If anomaly scores exceeding the threshold or special cases such as missing anchor points are detected in the current sliding window, it is determined that a disguised high-priority flooding attack may exist. At this time, to prevent abnormal data from polluting the baseline, updates to all baseline means and fluctuation scales are paused to maintain the historical normal state and ensure the reliability of subsequent anomaly detection.

[0121] As some examples, embodiments of the present invention can be implemented in each sliding window. At the end, firstly based on the total abnormality score Has the alarm threshold been exceeded? And check for "anchor point missing" alerts to determine if the current window is functioning correctly. If If no anchor points are missing, it is considered a normal window. At this point, for each anchor point... The baseline parameters for each component d are updated exponentially. Baseline mean The update formula is ,in, For updating coefficients (dimensionless, ranging from [0.001, 0.1]). Fluctuation scale. The update formula is This update method allows the baseline to slowly "track" and "absorb" reasonable, gradual systematic changes caused by vehicle operating conditions (such as load changes and driving mode switching), maintaining the robustness of the detection model to normal changes.

[0122] If in the current sliding window At the end, an attack is determined to have occurred (i.e., the total anomaly score). If an "anchor point missing" alarm is triggered, immediately pause the baseline mean calculation for all components of all anchor points. and fluctuation scale The baseline update is implemented. This means that even if an attacker sends a large number of disguised high-priority messages, causing an abnormal spike in observed fingerprint vector components (such as latency and violation rate), this anomalous data will not be included in the baseline calculation. This mechanism is a key strategy for defending against "attack window contamination of the baseline," ensuring that the normal behavior baseline of the system is not distorted or destroyed by malicious or anomalous data, thereby maintaining the discriminative ability of subsequent detection windows. Baseline updates will only be reactivated after the attack stops and the system is deemed normal again.

[0123] This invention establishes a dynamic baseline mean and fluctuation scale by using the components of the resource contention fingerprint vector based on anchor messages, and selectively updates or pauses the update of the baseline by using anomaly judgment results. This effectively prevents abnormal data from polluting the baseline model, thereby enhancing the system's adaptability to changes in normal operating conditions, improving the accuracy and robustness of anomaly detection, and helping to identify disguised high-priority flood attacks in a timely and reliable manner.

[0124] Optional, based on Figure 1 The method shown is as follows: Figure 3 The diagram shows a specific implementation of step S150 in the attack detection method provided by this invention. Step S150 may specifically include:

[0125] S300, calculate the difference between each component of the resource contention fingerprint vector and the corresponding baseline mean.

[0126] Specifically, in this embodiment of the invention, for each component of the resource contention fingerprint vector, the difference between the actual observed value of each component and its historical baseline mean can be calculated to reflect the degree of deviation between the current transmission behavior and normal operating conditions.

[0127] As some examples, embodiments of the present invention can be implemented in a sliding window. At the end, the anchor message has been completed. Calculate the resource contention fingerprint vector of the current window. And hold the baseline mean of each component d of the anchor point (d=1, 2, and 3 correspond to the mean of arbitration failure, the quantile of waiting in line, and the deadline violation rate, respectively). For each component of the fingerprint vector Calculate its mean with the corresponding baseline. The difference, i.e. This difference directly quantifies the absolute deviation of currently observed resource contention behavior (such as average contention intensity, latency severity, and frequency of anomalous events) from its historical normal baseline. A positive difference indicates that the current observation is higher than normal (e.g., longer wait times, increased violation rates), serving as an indication of a potential attack.

[0128] S310. Using the difference and fluctuation scale corresponding to each component, obtain the deviation of each component.

[0129] Specifically, in this embodiment of the invention, the difference of each component can be divided by the corresponding baseline fluctuation scale to obtain the standardized deviation, which measures the degree of abnormality of the component relative to the baseline mean, thereby eliminating the influence of the numerical units and fluctuation magnitudes of different components.

[0130] As examples, in order to eliminate differences in the dimensions and normal fluctuation range of different components and to make the outlier scores comparable and robust, embodiments of the present invention can calculate the absolute difference. Normalization is performed: a fluctuation scale pre-established and maintained for this component is used. (This represents the typical fluctuation range of the component under normal operating conditions) as the normalized denominator. The deviation of each component is calculated as follows: ,in It is an extremely small constant (ranging from [1e-9, 1e-3]) used to prevent fluctuations in scale. The case where the denominator is zero when the value is close to zero. This deviation is a dimensionless value that represents the degree to which the current observation deviates from its normal baseline, within the normal fluctuation range of the component itself. The deviation is a multiple of the unit. The greater the deviation, the more significant the behavioral abnormality in that dimension.

[0131] S320. Sum the deviations of all components of the resource contention fingerprint vector to obtain the anomaly score of the anchor message.

[0132] Specifically, in this embodiment of the invention, the deviation of each component can be summed to obtain the overall abnormal score of the anchor message. This score is used to represent the comprehensive abnormality of the anchor resource behavior.

[0133] As examples, embodiments of the present invention can input the deviation of all components of the resource contention fingerprint vector into the formula: The anomaly score of the anchor point message is obtained. Finally, the maximum anomaly score among all monitored anchor points is taken as the total anomaly score. The total anomaly score is a comprehensive, normalized metric used to characterize the overall degree of anomaly in the current bus resource contention state relative to the historical normal baseline, and is the core criterion for triggering the final attack alarm.

[0134] This invention calculates the standardized deviation by combining the difference between each component of the resource contention fingerprint vector and the corresponding baseline mean with the fluctuation scale, and accumulates the deviation of each component to obtain an anomaly score. This can accurately quantify the degree of anomaly in anchor message resource behavior, thereby enhancing the sensitivity and accuracy of anomaly detection, effectively identifying disguised high-priority flood attacks, and improving the system's security protection capabilities.

[0135] Optionally, in the above Figure 1 Based on one or more corresponding embodiments, in another optional embodiment provided by the present invention, the method may further include:

[0136] Within a specified sliding window, if an arbitration failure site is captured, the sites where each arbitration failure occurred are counted, and an arbitration failure site histogram is generated based on the statistical results; the degree of difference between the arbitration failure site histogram and the baseline histogram under normal operating conditions is calculated.

[0137] Specifically, in this embodiment of the invention, within a specified sliding window, all arbitration failure events are first detected and captured, and the specific site index corresponding to each arbitration failure is recorded. Then, the frequency of site occurrence is counted to construct a histogram of arbitration failure sites within the sliding window. Next, the histogram is compared with a pre-established baseline histogram of normal operating conditions, and the degree of anomaly in the distribution of arbitration failure sites within the current window is evaluated using a defined difference calculation method. This provides supplementary evidence for anomaly detection and helps improve the accuracy of locating spoofing attacks.

[0138] As examples, embodiments of the present invention can enable supplementary evidence collection when hardware support is available (such as a CAN controller capable of recording the precise location when arbitration fails): in a sliding window Within the window, every arbitration failure event occurring in all anchor messages is captured. Whenever an anchor message fails in arbitration, the location b of the arbitration failure is read from the controller or driver layer and recorded. At the end of the window, all recorded location events are iterated through, and the index b of each possible location is counted to obtain the number of times location b appeared within that window. (Dimensionless, values ​​are non-negative integers). Then, the counts for all sites are normalized to eliminate the impact of varying total number of arbitration failures within the window, generating a normalized histogram. The value of each histogram component is... Where b is the index of the arbitration failure site, and u is the site index used for summation. This histogram visually displays the distribution of "hot spots" where low-priority anchor messages collide with the opponent in arbitration within the current time window.

[0139] In generating the histogram of arbitration failure sites for this sliding window. Then, it is compared with a pre-learned and maintained baseline histogram representing the normal bus communication mode. Compare the baseline histograms. The long-term probability distribution of each arbitration failure site under normal operating conditions without attacks was recorded. The dissimilarity was calculated using a vector distance metric, specifically defined as... That is, for each locus b, take the absolute value of the difference between the current observed probability and the baseline probability, and then sum the absolute differences of all loci. This dissimilarity... It is a scalar value that quantifies the overall deviation of the current conflict point distribution pattern from the normal pattern. When a spoofing flood attack occurs, the attack packet participates in arbitration with its specific high-priority ID, causing the anchor packet to repeatedly fail at specific points (such as bit positions where the attack ID and anchor ID start differently), thus altering the histogram distribution. Significant deviation from normal baseline Difference This difference will increase accordingly. This difference can serve as strong supplementary evidence to the fingerprint vector anomaly score, enhancing the credibility of alerts and providing clues for analyzing the prefix characteristics of attack packet IDs.

[0140] This invention, by statistically analyzing the arbitration failure sites within a sliding window and constructing a histogram, combined with the difference analysis of the histogram with the normal operating condition baseline, can more finely identify the distribution characteristics of abnormal arbitration failures, thereby improving the detection accuracy and localization capability of spoofed high-priority flooding attacks.

[0141] Optionally, in the above Figure 1 Based on one or more corresponding embodiments, in another optional embodiment provided by the present invention, after step S160, the method may further include:

[0142] Output fake flood alarm information and trigger the gateway to execute security policies. These security policies include limiting the transmission of non-critical packets, enabling whitelist verification for suspicious high-priority packet IDs, or triggering system security degradation mode.

[0143] Specifically, in this embodiment of the invention, when the abnormal score of anchor messages within a sliding window exceeds a set threshold, or when phenomena such as missing anchors or abnormal differences in arbitration failure sites occur, alarm information is immediately generated, including one or more detailed parameters such as anchor ID, window time, abnormal score, trigger index, distribution of arbitration failure sites, and the number of arbitration failures and queuing time of neighboring windows. This information is recorded in the security log or reported to the security operation and maintenance platform for subsequent analysis and evidence collection.

[0144] In this embodiment of the invention, the rate limiting for sending non-critical messages refers to automatically adjusting the scheduling strategy of the message sending queue based on a pre-set security policy. This dynamically reduces the sending frequency of low-priority or non-critical business messages, prioritizing critical business and diagnostic communications, and reducing the risk of resource abuse.

[0145] In this embodiment of the invention, enabling whitelist verification for suspicious high-priority message IDs refers to automatically analyzing the arbitration failure sites and / or the distribution of high-priority IDs within the current abnormal window, identifying high-priority message IDs that may initiate flooding, and adding them to the whitelist verification range; and taking measures such as discarding, slowing down, and issuing alarms for high-priority messages that are not on the whitelist to suppress the injection of spoofed attack data from the source.

[0146] The trigger system security degradation mode provided in this embodiment of the invention refers to the gateway automatically switching to security degradation mode when continuous anomalies are detected or the alarm level reaches a preset high-risk threshold. This mode restricts some non-core functions, disables the processing of dangerous commands, or minimizes the impact of potential attacks on vehicle control and safety by isolating the bus or entering a "safe mode".

[0147] This invention effectively curbs the spread of attacks and ensures the security and stability of vehicle bus communication by promptly outputting alarm information and triggering multi-layered security strategies, including rate limiting for non-critical messages, whitelist verification for high-priority messages, and system security degradation, after determining that a high-priority flooding attack has been detected.

[0148] Optionally, in the above Figure 1 Based on one or more corresponding embodiments, in another optional embodiment provided by the present invention, the method may further include:

[0149] When the anchor message is sent from a non-local location, the anchor message is configured to report the number of arbitration failures, queuing time, and deadline violation amount collected through high-priority messages or independent communication channels; if no data is received from the anchor message within the sliding window, an anchor missing alarm is output.

[0150] Specifically, this embodiment of the invention, for anchor messages not sent locally, records the number of arbitration failures, queuing time, and deadline violation indicators in real time on the remote ECU side. Statistical data is sent to the gateway via a pre-configured high-priority CAN diagnostic frame or independent communication link (such as Ethernet or a dedicated diagnostic bus) to ensure that report messages are still transmitted with priority even under high bus load, avoiding data reporting blockage or delay. Within each sliding window period, resource contention data uploaded by remote anchors is received and cached in real time, and sample aggregation and statistical analysis are performed to ensure the integrity and accuracy of the fingerprint vector. If, within the current sliding window, the reported data of an anchor is detected as not arriving on time or is missing, an "anchor missing" alarm mechanism is immediately triggered, recording the missing anchor ID, missing time window, and corresponding sampling point information for subsequent engineering diagnostics and safety policy responses. Simultaneously, the fingerprint update and baseline adaptation process for that anchor data is skipped to prevent misleading anomaly determinations.

[0151] As some examples, embodiments of the present invention can be implemented in anchor messages. When the sending end is a remote ECU (not local to the gateway), a reliable reporting mechanism is pre-configured to ensure that its resource behavior data can be transmitted to the detection system located at the gateway in a timely and complete manner. Specifically, the configuration can be as follows: In the remote ECU, for each anchor point message... After each successful transmission or at a fixed period, the number of arbitration failures collected will be recorded. Queueing time and deadline violation of the order quantity These three key metrics are packaged together. Then, this data packet is forced to be sent using a high-priority diagnostic message or a physically or logically independent communication channel (such as an Ethernet backup link or a dedicated high-priority CAN channel) to circumvent attack scenarios: when the bus is severely congested due to a spoofing flood attack, low-priority reporting messages themselves will be blocked, causing the detection system to become blind. Reporting via a high-priority or independent channel ensures that even under attack, the monitoring data stream can obtain communication resources, ensuring the continuity and accuracy of detection.

[0152] In each sliding window At the end, examine each remote anchor point that was expected to receive reported data. If for a certain anchor point In the sliding window Throughout the entire time interval, it did not receive any of the sample data (i.e., sample sets) sent through high-priority or independent channels. Empty, number of samples If the anchor point is "missing," then it is determined to be "missing." An "Anchor Point Missing" alarm can be generated and output immediately. This alarm is a clear anomaly signal, indicating either a malfunction in the remote ECU's reporting function or an attack that prevents the anchor point message from getting any chance to be sent in the local ECU's transmission queue, resulting in no successful transmissions triggering data reporting. Regardless of the cause, "Anchor Point Missing" signifies that the monitoring point is invalid, with the latter directly indicating extreme resource congestion. When handling this alarm, fingerprint calculation and baseline updates for the anchor point in this window are skipped to prevent invalid data interference. This alarm is also used as one of the important bases for triggering higher-level security policies.

[0153] This invention ensures timely reporting of critical resource behavior data by using high-priority messages or independent communication channels when the anchor message sending side is not local, and outputs an anchor point missing alarm in a timely manner when data is missing within the sliding window. This significantly improves the reliability of detection and the accuracy of attack response, and effectively prevents misjudgment and missed detection caused by data delay or loss.

[0154] Although the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous.

[0155] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0156] Corresponding to the above method embodiments, this invention also provides an attack detection device, the structure of which is as follows: Figure 4 As shown, it may include: anchor message acquisition unit 10, message transmission data acquisition unit 20, queuing waiting time acquisition unit 30, deadline violation indicator generation unit 40, resource contention fingerprint vector generation unit 50, abnormal score acquisition unit 60 and spoofing flood attack determination unit 70.

[0157] Anchor message acquisition unit 10 is used to acquire anchor messages of the controller local area network bus, wherein the anchor message is configured with an anchor expiration period.

[0158] The message transmission data acquisition unit 20 is used to collect the number of arbitration failures, queuing time, and actual transmission time of each transmission process on the sending side of the anchor message.

[0159] The queuing waiting time acquisition unit 30 is used to obtain the queuing waiting time by utilizing the enqueuing time and the actual sending time.

[0160] The deadline violation indicator generation unit 40 is used to generate a deadline violation indicator by utilizing the queuing waiting time and the anchor deadline.

[0161] The resource contention fingerprint vector generation unit 50 is used to summarize multiple transmission samples of anchor point messages within a specified sliding window, and generate a resource contention fingerprint vector by utilizing the number of arbitration failures, queuing time, and deadline violation indication.

[0162] The anomaly score acquisition unit 60 is used to compare the resource contention fingerprint vector with a pre-built adaptive baseline to obtain the anomaly score of the anchor message.

[0163] The fake flood attack determination unit 70 is used to determine the existence of a fake high-priority flood attack when the abnormal score is greater than a preset threshold.

[0164] Optionally, the anchor message acquisition unit 10 can be used to acquire low-priority periodic messages sent locally by the gateway of the controller local area network bus or low-priority test messages actively injected by the gateway as anchor messages.

[0165] Optionally, the resource contention fingerprint vector generation unit 50 can be used to collect a sample set of successfully sent anchor messages within a specified sliding window; calculate the average number of arbitration failures for all samples in the sample set to obtain the arbitration failure mean; calculate the preset quantile of the queuing time for all samples in the sample set to obtain the queuing quantile; use the deadline violation indicator to statistically analyze the proportion of samples in the sample set that have experienced deadline violations to obtain the deadline violation rate; and combine the arbitration failure mean, the queuing quantile, and the deadline violation rate into a resource contention fingerprint vector.

[0166] Optionally, the attack detection device may also include an adaptive baseline building unit.

[0167] The adaptive baseline construction unit is used to establish the baseline mean and fluctuation scale for each component of the resource contention fingerprint vector of the anchor message. Within a specified sliding window, if it is determined that there is no spoofed high-priority flooding attack, the baseline mean and fluctuation scale are updated exponentially; otherwise, the update of the baseline mean and fluctuation scale is paused.

[0168] Optionally, the anomaly score acquisition unit 60 can be used to calculate the difference between each component of the resource contention fingerprint vector and the corresponding baseline mean; use the difference and fluctuation scale corresponding to each component to obtain the deviation of each component; and sum the deviations of all components of the resource contention fingerprint vector to obtain the anomaly score of the anchor message.

[0169] Optionally, the attack detection device may also include an attack evidence supplementation unit.

[0170] The attack evidence supplement unit is used to, within a specified sliding window, if an arbitration failure site is captured, count the sites where each arbitration failure occurs, and generate an arbitration failure site histogram based on the statistical results; and calculate the degree of difference between the arbitration failure site histogram and the baseline histogram under normal operating conditions.

[0171] Optionally, the attack detection device may also include an attack alarm unit.

[0172] The attack alarm unit is used to detect spoofed flood attacks. After the spoofed flood attack detection unit 70 detects the existence of a spoofed high-priority flood attack, it outputs a spoofed flood alarm message and triggers the gateway to execute security policies. The security policies include limiting the transmission of non-critical packets, enabling whitelist verification for suspicious high-priority packet IDs, or triggering a system security downgrade mode.

[0173] Optionally, the attack detection device may also include a remote anchor point management unit.

[0174] The remote anchor management unit is used to configure anchor messages to report the number of arbitration failures, queuing time, and deadline violation amount through high-priority messages or independent communication channels when the sending side of the anchor message is not local. If no anchor message is received within the sliding window, an anchor missing alarm is output.

[0175] This invention provides an attack detection device, which is used to: obtain anchor packets of a controller area network bus, wherein the anchor packets are configured with anchor deadlines; collect the number of arbitration failures, queuing time, and actual transmission time of each transmission process of the anchor packets from the sending side; obtain the queuing time using the queuing time and actual transmission time; generate a deadline violation indicator using the queuing time and anchor deadline; summarize multiple transmission samples of anchor packets within a specified sliding window, and generate a resource contention fingerprint vector using the number of arbitration failures, queuing time, and deadline violation indicator; compare the resource contention fingerprint vector with a pre-constructed adaptive baseline to obtain an anomaly score of the anchor packets; and determine the existence of a disguised high-priority flooding attack if the anomaly score is greater than a preset threshold. This invention constructs a fingerprint vector reflecting the bus resource contention status by collecting the number of arbitration failures, queuing time, and deadline violation indicator of anchor packets during transmission, and compares it with an adaptive baseline to accurately capture resource contention anomalies caused by disguised high-priority flooding attacks, thereby achieving accurate identification of this type of attack.

[0176] Regarding the apparatus in the above embodiments, the specific manner in which each unit performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0177] The attack detection device includes a processor and a memory. The anchor message acquisition unit 10, message transmission data acquisition unit 20, queuing time acquisition unit 30, deadline violation indicator generation unit 40, resource contention fingerprint vector generation unit 50, abnormal score acquisition unit 60, and spoofing flood attack determination unit 70 are all stored as program units in the memory. The processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0178] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured; by adjusting kernel parameters, the processor can monitor low-level resource contention characteristics, accurately identify anomalies caused by spoofed high-priority attacks, and improve the accuracy and robustness of attack detection.

[0179] This invention provides a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements the attack detection method.

[0180] This invention provides a processor for running a program, wherein the program executes the attack detection method during runtime.

[0181] like Figure 5 As shown, this embodiment of the invention provides an electronic device 1000, which includes at least one processor 1001, at least one memory 1002 connected to the processor 1001, and a bus 1003. The processor 1001 and the memory 1002 communicate with each other via the bus 1003. The processor 1001 is used to call program instructions in the memory 1002 to execute the aforementioned attack detection method. The electronic device in this document can be a server, PC, PAD, mobile phone, ECU (Electronic Control Unit), VCU (Vehicle Control Unit), MCU (Micro Controller Unit), HCU (Hybrid Control Unit), etc.

[0182] The present invention also provides a computer program product that, when executed on an electronic device, is suitable for executing a program that initializes an attack detection method step.

[0183] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatuses, electronic devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0184] In a typical configuration, an electronic device includes one or more processors (CPUs), memory, and a bus. The electronic device may also include input / output interfaces, network interfaces, etc.

[0185] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and memory includes at least one memory chip. Memory is an example of computer-readable media.

[0186] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0187] In the description of this invention, it should be understood that if the terms "upper", "lower", "front", "rear", "left" and "right" are used to indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, they are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the position or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this invention.

[0188] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0189] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0190] The above are merely embodiments of the present invention and are not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the present invention.

Claims

1. An attack detection method, characterized in that, include: Obtain the anchor message of the controller local area network bus, wherein the anchor message is configured with an anchor expiration period; Collect the number of arbitration failures, queuing time, and actual transmission time of each transmission process on the sending side of the anchor point message; The queuing time is obtained using the enqueue time and the actual sending time; Using the queue waiting time and the anchor point deadline, a deadline violation indication is generated; Multiple transmission samples of the anchor point message are aggregated within a specified sliding window, and a resource contention fingerprint vector is generated using the number of arbitration failures, the queuing time, and the deadline violation indication. The resource contention fingerprint vector is compared with a pre-built adaptive baseline to obtain the anomaly score of the anchor message; If the abnormal score is greater than a preset threshold, it is determined that a disguised high-priority flood attack exists.

2. The method according to claim 1, characterized in that, The anchor message for obtaining the controller local area network bus includes: Obtain low-priority periodic messages sent locally by the gateway on the controller local area network bus or low-priority test messages actively injected by the gateway as anchor messages.

3. The method according to claim 1, characterized in that, The step of summarizing multiple transmission samples of the anchor point message within a specified sliding window, and generating a resource contention fingerprint vector using the number of arbitration failures, the queuing time, and the deadline violation indication, includes: Collect a set of samples of successfully sent anchor messages within a specified sliding window; Calculate the average number of arbitration failures for all samples in the sample set to obtain the mean arbitration failure rate; Calculate the preset quantile of the queuing time for all samples in the sample set to obtain the queuing quantile; Using the deadline violation indicator, the proportion of samples in the sample set that have experienced deadline violations is calculated to obtain the deadline violation rate; The mean arbitration failure, the queuing waiting quantile, and the deadline violation rate are combined to form a resource competition fingerprint vector.

4. The method according to claim 1, characterized in that, The process of constructing the adaptive baseline includes: Establish a baseline mean and fluctuation scale for each component of the resource contention fingerprint vector of the anchor message; Within the specified sliding window, if it is determined that there is no disguised high-priority flooding attack, the baseline mean and the fluctuation scale are updated exponentially; otherwise, the update of the baseline mean and the fluctuation scale is paused.

5. The method according to claim 4, characterized in that, The step of comparing the resource contention fingerprint vector with a pre-built adaptive baseline to obtain the anomaly score of the anchor message includes: Calculate the difference between each component of the resource contention fingerprint vector and the corresponding baseline mean; The deviation of each component is obtained by using the difference and the fluctuation scale corresponding to each component; The deviation of all components of the resource contention fingerprint vector is summed to obtain the anomaly score of the anchor message.

6. The method according to claim 1, characterized in that, Also includes: Within the specified sliding window, if an arbitration failure site is captured, the sites where each arbitration failure occurred are counted, and an arbitration failure site histogram is generated based on the statistical results. Calculate the degree of difference between the histogram of the arbitration failure sites and the baseline histogram under normal operating conditions.

7. The method according to claim 1, characterized in that, After determining that a disguised high-priority flood attack exists, the method further includes: Output a fake flood alarm message and trigger the gateway to execute security policies, including limiting the transmission of non-critical messages, enabling whitelist verification for suspicious high-priority message IDs, or triggering a system security degradation mode.

8. The method according to any one of claims 1 to 7, characterized in that, Also includes: When the sending side of the anchor message is not local, the anchor message is configured to report the number of arbitration failures, the queuing time and the number of deadline violations collected through high-priority messages or independent communication channels. If no data is received from the anchor point message within the sliding window, an anchor point missing alarm is output.

9. An attack detection device, characterized in that, include: Anchor message acquisition unit, message transmission data acquisition unit, queuing time acquisition unit, deadline violation instruction generation unit, resource contention fingerprint vector generation unit, abnormal score acquisition unit, and spoofing flood attack judgment unit; The anchor message acquisition unit is used to acquire the anchor message of the controller local area network bus, wherein the anchor message is configured with an anchor expiration period. The message transmission data acquisition unit is used to collect the number of arbitration failures, queuing time and actual transmission time of each transmission process on the sending side of the anchor message; The queuing waiting time acquisition unit is used to obtain the queuing waiting time using the queuing time and the actual sending time; The deadline violation indication generation unit is used to generate a deadline violation indication using the queuing waiting time and the anchor point deadline. The resource contention fingerprint vector generation unit is used to summarize multiple transmission samples of the anchor message within a specified sliding window, and generate a resource contention fingerprint vector using the number of arbitration failures, the queuing time, and the deadline violation indication. The anomaly score acquisition unit is used to compare the resource contention fingerprint vector with a pre-built adaptive baseline to obtain the anomaly score of the anchor message. The spoofing flood attack determination unit is used to determine the existence of a spoofing high-priority flood attack when the abnormal score is greater than a preset threshold.

10. An electronic device, characterized in that, The electronic device includes at least one processor, at least one memory connected to the processor, and a bus; wherein the processor and the memory communicate with each other through the bus; the processor is used to call program instructions in the memory to execute the attack detection method as described in any one of claims 1 to 8.

Images