DOS attack detection method and storage medium for vehicle CAN network

Abstract

The present invention discloses a DOS attack detection method and storage medium for a vehicle CAN network, the method comprising: generating a remote frame set according to a CAN matrix table; a detection node sequentially acquiring a remote frame and broadcasting it to a CAN bus according to a preset broadcast period; the detection node statistically retrieves the number of other frames received between the remote frame and the corresponding data frame, obtains a count value, and stores it in a storage queue; according to a preset analysis period, respectively calculates the proportion of the number of count values ​​exceeding a preset comparison threshold in the storage queue of each remote frame to the total number of count values, and obtains the first proportion corresponding to each remote frame; respectively judges whether the first proportion corresponding to each remote frame exceeds the calibration threshold corresponding to each remote frame, and adjusts the intrusion risk value according to the judgment result; if the intrusion risk value exceeds the preset risk threshold, it is determined that a DOS attack is suffered. The present invention can detect potential DOS attacks in a timely manner.

Description

Technical Field

[0001] The present invention relates to the technical field of attack detection, and in particular to a DOS attack detection method and storage medium for a vehicle CAN network. Background Art

[0002] When the CAN protocol in the car was first designed, it was quickly promoted in the automotive industry and became the standard for internal network communication in the car due to its effectiveness, reliability, ease of use, real-time performance and many other characteristics. However, as time goes by, more and more devices can be connected to the in-car network, and the vulnerability of the CAN protocol itself is exposed, becoming the target of car hacker attacks. As long as it can access the in-car CAN network, any device can inject data into the CAN bus, and the simplest and most common attack is the DOS attack. It does not need to analyze the in-car CAN data protocol, but only continuously injects invalid data into the bus, causing the CAN bus to overload and the in-car functions to fail. If the DOS attack lurks in the car and attacks at high speeds, it will be a serious security threat. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a DOS attack detection method and storage medium for a vehicle CAN network, which can detect potential DOS attacks in time to avoid harm to personnel and vehicles.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is: a DOS attack detection method for a vehicle CAN network, wherein a detection node is also provided on the CAN bus of the vehicle CAN network; the method comprises:

[0005] Generate a remote frame set according to the CAN matrix table, wherein the ID of each remote frame in the remote frame set is respectively an ID preset in the CAN matrix table;

[0006] The detection node cyclically obtains a remote frame from the remote frame set in sequence according to a preset broadcast period, and broadcasts the remote frame to the CAN bus;

[0007] The detection node retrieves the remote frame;

[0008] The detection node counts the number of other frames received between the time when the remote frame is retrieved and the time when the data frame corresponding to the remote frame is received, obtains a count value, and stores the count value in a storage queue corresponding to the remote frame;

[0009] According to a preset analysis period, respectively calculate the ratio of the number of count values ​​exceeding a preset comparison threshold in the storage queue corresponding to each remote frame to the total number of count values ​​in the storage queue, to obtain a first ratio corresponding to each remote frame;

[0010] respectively judging whether the first proportion corresponding to each remote frame exceeds the calibration threshold corresponding to each remote frame, and adjusting the intrusion risk value according to the judgment result;

[0011] If the intrusion risk value exceeds the preset risk threshold, it is determined to be a DOS attack.

[0012] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the above steps are implemented.

[0013] The beneficial effect of the present invention is that: by adding an active detection node in the CAN network, the detection node actively sends a remote frame with a CAN ID to the CAN bus, and then the CAN data received between the remote frame and the corresponding data frame are counted, and then the statistical data are analyzed to achieve intrusion detection of DOS attacks. The present invention can timely and effectively detect potential DOS attacks in the vehicle CAN network, thereby avoiding damage to personnel and vehicles. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A flow chart of a DOS attack detection method for a vehicle CAN network of the present invention;

[0015] Figure 2 A topological diagram of a vehicle CAN network according to the first embodiment of the present invention;

[0016] Figure 3 The method flow of the first embodiment of the present invention is as follows Figure 1 ;

[0017] Figure 4 The method flow of the first embodiment of the present invention is as follows Figure 2 . DETAILED DESCRIPTION

[0018] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

[0019] The most critical concept of the present invention is: based on the principle that the response of the in-vehicle CAN network to the remote frame when not attacked is within a reasonable distribution range, the characteristics of the remote frame are utilized to actively send the remote frame for detection, and through quantified response, intrusion detection can be achieved using a simple statistical method.

[0020] See also Figure 1 , a DOS attack detection method for a vehicle CAN network, wherein a detection node is also provided on a CAN bus of the vehicle CAN network; the method comprises:

[0021] Generate a remote frame set according to the CAN matrix table, wherein the ID of each remote frame in the remote frame set is respectively an ID preset in the CAN matrix table;

[0022] The detection node cyclically obtains a remote frame from the remote frame set in sequence according to a preset broadcast period, and broadcasts the remote frame to the CAN bus;

[0023] The detection node retrieves the remote frame;

[0024] The detection node counts the number of other frames received between the time when the remote frame is retrieved and the time when the data frame corresponding to the remote frame is received, obtains a count value, and stores the count value in a storage queue corresponding to the remote frame;

[0025] According to a preset analysis period, respectively calculate the ratio of the number of count values ​​exceeding a preset comparison threshold in the storage queue corresponding to each remote frame to the total number of count values ​​in the storage queue, to obtain a first ratio corresponding to each remote frame;

[0026] respectively judging whether the first proportion corresponding to each remote frame exceeds the calibration threshold corresponding to each remote frame, and adjusting the intrusion risk value according to the judgment result;

[0027] If the intrusion risk value exceeds the preset risk threshold, it is determined to be a DOS attack.

[0028] From the above description, it can be seen that the beneficial effect of the present invention is that the present invention can timely and effectively detect potential DOS attacks in the vehicle CAN network, thereby avoiding damage to personnel and vehicles.

[0029] Furthermore, the detection node retrieves the remote frame specifically as follows:

[0030] The detection node collects a frame of CAN data from the CAN bus;

[0031] Determine whether the frame of CAN data is the remote frame;

[0032] If yes, the remote frame acquisition flag is set to "acquired" and the value of the receiving counter is cleared;

[0033] If not, continue to execute the step of the detection node collecting a frame of CAN data from the CAN bus.

[0034] As can be seen from the above description, by setting the remote frame acquisition mark, it is convenient to judge whether the remote frame has been acquired later; by clearing the value of the receiving counter, the influence of the counting data in the detection process of other remote frames is avoided.

[0035] Further, the detection node counts the number of other frames received between the remote frame and the data frame corresponding to the remote frame, obtains a count value, and stores the count value in a storage queue corresponding to the remote frame, specifically:

[0036] When the detection node receives a frame of CAN data from the CAN bus, it determines whether the remote frame has been collected according to the remote frame collection mark;

[0037] If it has been collected, the value of the receiving counter is increased by one;

[0038] Determine whether the ID in a currently received CAN data frame is the same as the ID of the remote frame;

[0039] If they are the same, the value of the receiving counter is stored in the storage queue corresponding to the remote frame, and the remote frame collection flag and the value of the receiving counter are cleared.

[0040] From the above description, it can be known that the number of other CAN data received between the receipt of the remote frame and the receipt of the corresponding data frame can be accurately counted.

[0041] Furthermore, after increasing the value of the receiving counter by one, the method further comprises:

[0042] If the value of the receiving counter exceeds a preset maximum waiting threshold, the value of the receiving counter is stored in a storage queue corresponding to the remote frame, and the remote frame collection flag and the value of the receiving counter are cleared.

[0043] It can be seen from the above description that when the value of the receiving counter exceeds the maximum waiting threshold, the current count value is directly recorded, and the response detection of the current remote frame is ended to avoid affecting the response detection of the next remote frame.

[0044] Furthermore, after judging whether the remote frame has been collected according to the remote frame collection mark, the method further comprises:

[0045] If not, the detection node waits to receive the next frame of CAN data, and when the next frame of CAN data is received, continues to execute the step of determining whether the remote frame has been collected according to the remote frame collection mark.

[0046] Furthermore, after determining whether the ID in the currently received frame of CAN data is the same as the ID of the remote frame, the method further includes:

[0047] If they are not the same, the detection node waits to receive the next frame of CAN data, and when receiving the next frame of CAN data, continues to execute the step of determining whether the remote frame has been collected according to the remote frame collection mark.

[0048] Furthermore, the ratio of the number of count values ​​exceeding the preset comparison threshold in the storage queue corresponding to each remote frame to the total number of count values ​​in the storage queue is calculated respectively, and the first ratio corresponding to each remote frame is obtained as follows:

[0049] Counting the number of count values ​​exceeding a preset comparison threshold in a storage queue corresponding to a remote frame to obtain a first number;

[0050] Counting the total number of count values ​​in the storage queue corresponding to the remote frame to obtain a second number;

[0051] Divide the first number by the second number to obtain a first proportion corresponding to the remote frame.

[0052] From the above description, it can be seen that if the count value exceeds the preset comparison threshold, that is, in the response detection process of obtaining the count value, too much other CAN data is received between the remote frame being retrieved and the corresponding data frame being received, then it is considered that the response process is suspected of being attacked by DOS; by calculating the first proportion corresponding to the remote frame, the proportion of the remote frame that may be attacked by DOS during multiple response detection processes is counted.

[0053] Furthermore, the respectively determining whether the first proportion corresponding to each remote frame exceeds the calibration threshold corresponding to each remote frame, and adjusting the intrusion risk value according to the determination result is specifically:

[0054] If a first proportion corresponding to a remote frame exceeds a calibration threshold corresponding to the remote frame, a preset risk value is added to the intrusion risk value.

[0055] Furthermore, the analysis period is greater than the broadcast period.

[0056] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the above steps are implemented.

[0057] Embodiment 1

[0058] Please refer to Figure 2-4 , Embodiment 1 of the present invention is: a DOS attack detection method for a vehicle CAN network, which can be applied to a vehicle CAN network.

[0059] The existing vehicle CAN network includes multiple nodes, which are connected to the CAN bus respectively, and each node has its corresponding ID. The topology diagram of the vehicle CAN network in this embodiment is as follows: Figure 2 As shown, compared with the original network topology, a dedicated physical detection node is added to the CAN bus of this embodiment to detect potential DOS attacks.

[0060] In addition, this embodiment is based on the following characteristics of the vehicle CAN network:

[0061] 1. The CAN matrix table inside the vehicle is limited, that is, the number of nodes in the CAN network is limited;

[0062] 2. The detection node can read back the data on the CAN bus, that is, the detection node needs to be set to the recovery mode;

[0063] 3. CAN remote frames can be used to actively query other nodes;

[0064] 4. Other nodes need to reply with data frames immediately when receiving remote frame queries, that is, nodes with the same ID as the remote frame need to broadcast a data frame with the ID on the bus immediately when receiving the remote frame;

[0065] 5. For remote frames and data frames with the same ID, the remote frame has a higher priority in the use of the CAN bus;

[0066] 6. Any node can broadcast CAN protocol data to the CAN bus.

[0067] This embodiment is mainly divided into two parts. The first part is the process of broadcasting, retrieving and detecting remote frames, and the second part is the analysis of the detection results of the first part.

[0068] like Figure 3 As shown, the method includes:

[0069] S101: Generate a remote frame set according to the CAN matrix table, wherein the IDs in the arbitration segment of each remote frame in the remote frame set are respectively the IDs preset in the CAN matrix table. Since the IDs in the CAN matrix table are the IDs of the nodes in the CAN network, the IDs of each remote frame in the remote frame set correspond to the IDs of each node.

[0070] Furthermore, a one-to-one corresponding storage queue is created for each remote frame to store the statistical information of each remote frame waiting for response. Since the remote frame can be identified by an ID, it is equivalent to that each ID in the remote frame set has a corresponding storage queue.

[0071] S102: The detection node cyclically obtains a remote frame from the remote frame set in sequence according to a preset broadcast period, and broadcasts the remote frame to the CAN bus; that is, the detection node cyclically traverses each remote frame in the remote frame set, and broadcasts the currently traversed remote frame to the CAN bus according to the preset broadcast period. Preferably, the broadcast period is 10ms.

[0072] Furthermore, between broadcasting the remote frame and broadcasting the next remote frame, the current ID is set to the ID of the remote frame, that is, in the current broadcast cycle, the current ID is set to the ID of the currently broadcast remote frame. And, steps S103-S111 are performed in the current broadcast cycle.

[0073] S103: The detection node retrieves a frame of CAN data from the CAN bus, that is, retrieves immediately after broadcasting a remote frame. Since the remote frame has a higher priority, generally speaking, retrieving immediately after broadcasting a remote frame can immediately retrieve the remote frame that has just been broadcast.

[0074] S104: Determine whether the one frame of CAN data is the one remote frame. If so, execute step S105. If not, continue to retrieve one frame of CAN data from the CAN bus, that is, execute step S103.

[0075] Furthermore, whether the frame CAN data is the remote frame can be determined by judging whether the ID of the frame CAN data is the same as the ID of the remote frame, that is, whether it is the same as the current ID. If they are the same, the frame CAN data is determined to be a remote frame broadcast in the current broadcast cycle.

[0076] S105: Set the remote frame acquisition flag to acquired, and clear the value of the receiving counter.

[0077] S106: When the detection node receives a frame of CAN data from the CAN bus, it determines whether the remote frame has been collected according to the remote frame collection mark. If so, step S107 is executed, and if not, step S111 is executed. After the detection node broadcasts the remote frame, it can wait to receive CAN data. Among them, if the remote frame collection mark is collected, it is determined that the remote frame has been collected, otherwise a remote frame broadcasted in the current broadcast cycle has not been collected.

[0078] S107: Increment the value of the receiving counter by one.

[0079] S108: Determine whether the value of the receiving counter exceeds the preset maximum waiting threshold, if yes, execute step S110, if no, execute step S109. By comparing with the maximum waiting threshold, the detection time of the currently broadcast remote frame is controlled to prevent interference with the detection of subsequent remote frames.

[0080] S109: Determine whether the ID in the currently received CAN data frame is the same as the ID of the remote frame, that is, determine whether the currently received CAN data frame is the data frame corresponding to the remote frame. If so, execute step S110; if not, execute step S111.

[0081] S110: Store the value of the receiving counter in the storage queue corresponding to the remote frame, and clear the remote frame acquisition mark and the value of the receiving counter; that is, set the remote frame acquisition mark to empty or not acquired, and clear the value of the receiving counter. Then continue to obtain the next remote frame from the remote frame set, and when the next broadcast cycle is reached, broadcast the next remote frame to the CAN bus, that is, continue to execute step S102.

[0082] S111: The detection node waits to receive the next frame of CAN data, and when receiving the next frame of CAN data, determines whether the remote frame has been collected according to the remote frame collection mark, that is, executes step S106.

[0083] like Figure 4 As shown, the method also includes:

[0084] S201: According to a preset analysis period, respectively calculate the ratio of the number of count values ​​exceeding a preset comparison threshold in the storage queue corresponding to each remote frame to the total number of count values ​​in the storage queue, and obtain a first proportion corresponding to each remote frame. Specifically, each time an analysis period is reached, the following operations are performed on each storage queue: the number of count values ​​exceeding a preset comparison threshold in the storage queue corresponding to a remote frame is counted to obtain a first number; the total number of count values ​​in the storage queue corresponding to the remote frame is counted to obtain a second number; the first number is divided by the second number to obtain a first proportion corresponding to the remote frame.

[0085] Wherein, the analysis period is much longer than the broadcast period, and preferably, the analysis period is 2s. By making the analysis period as longer than the broadcast period as possible, each storage queue can obtain multiple count values ​​in each analysis period, which helps the accuracy of subsequent analysis. For example, assuming that the broadcast period is 10ms, the analysis period is 2s, and there are 10 remote frames in the remote frame set, since 1 analysis period is equal to 200 broadcast periods, the remote frame set is looped 20 times in 1 analysis period, then after each analysis period, 20 count values ​​(the value of the receiving counter) are added to the storage queue corresponding to each remote frame.

[0086] S202: Determine whether the first proportion corresponding to each remote frame exceeds the calibration threshold corresponding to each remote frame, and adjust the intrusion risk value according to the determination result. Specifically, traverse each remote frame, if the first proportion corresponding to a remote frame exceeds the calibration threshold corresponding to the remote frame, then add a preset risk value to the intrusion risk value. The calibration threshold can be set in advance according to the actual situation of the vehicle.

[0087] Among them, the increased risk value can be allocated according to the proportion of the CAN node corresponding to the ID of the remote frame in the message volume in the vehicle. For example, when the message volume of a certain CAN node accounts for 20% of the actual total message volume in the vehicle, when the first proportion corresponding to the remote frame with the same ID as the node exceeds the corresponding calibration threshold, the intrusion risk value increases by 20.

[0088] S203: Determine whether the intrusion risk value exceeds a preset risk threshold, if so, execute step S204, if not, it is considered that the overall intrusion risk value is within a reasonable range and has not been subjected to a DOS attack. The risk threshold can be set in advance according to the actual situation of the vehicle.

[0089] S204: Determine that a DOS attack has occurred, and further issue an alarm.

[0090] Many existing technical solutions are passive detection, that is, detection is performed based on the original incoming data, so the uncertainty of the data is very large, and complex statistical algorithms / models are required to obtain the detection results. This embodiment uses the characteristics of the vehicle CAN network itself to add an active detection node in the CAN network to be detected. The detection node actively sends the legal CAN ID remote frame in the CAN matrix to the CAN bus. Since the remote frame has a higher priority, it can be sent out first and get a reply immediately. When it is not attacked, the response of the CAN network in the car to the remote frame is within a reasonable distribution range. This embodiment can achieve intrusion detection by quantifying the response and using a simple statistical method, which has better results in application scenarios with real-time requirements and limited ECU resources in the car.

[0091] Compared with the traditional complex statistical model, this embodiment is more suitable for the current automotive field and can effectively and quickly detect potential DOS attacks in the vehicle CAN network.

[0092] Embodiment 2

[0093] This embodiment is a computer-readable storage medium corresponding to the above embodiment, on which a computer program is stored. When the program is executed by a processor, the following steps are implemented:

[0094] Generate a remote frame set according to the CAN matrix table, wherein the ID of each remote frame in the remote frame set is respectively an ID preset in the CAN matrix table;

[0095] The detection node cyclically obtains a remote frame from the remote frame set in sequence according to a preset broadcast period, and broadcasts the remote frame to the CAN bus;

[0096] The detection node retrieves the remote frame;

[0097] The detection node counts the number of other frames received between the time when the remote frame is retrieved and the time when the data frame corresponding to the remote frame is received, obtains a count value, and stores the count value in a storage queue corresponding to the remote frame;

[0098] According to a preset analysis period, respectively calculate the ratio of the number of count values ​​exceeding a preset comparison threshold in the storage queue corresponding to each remote frame to the total number of count values ​​in the storage queue, to obtain a first ratio corresponding to each remote frame;

[0099] respectively judging whether the first proportion corresponding to each remote frame exceeds the calibration threshold corresponding to each remote frame, and adjusting the intrusion risk value according to the judgment result;

[0100] If the intrusion risk value exceeds the preset risk threshold, it is determined to be a DOS attack.

[0101] Furthermore, the detection node retrieves the remote frame specifically as follows:

[0102] The detection node collects a frame of CAN data from the CAN bus;

[0103] Determine whether the frame of CAN data is the remote frame;

[0104] If yes, the remote frame acquisition flag is set to "acquired" and the value of the receiving counter is cleared;

[0105] If not, continue to execute the step of the detection node collecting a frame of CAN data from the CAN bus.

[0106] Further, the detection node counts the number of other frames received between the remote frame and the data frame corresponding to the remote frame, obtains a count value, and stores the count value in a storage queue corresponding to the remote frame, specifically:

[0107] When the detection node receives a frame of CAN data from the CAN bus, it determines whether the remote frame has been collected according to the remote frame collection mark;

[0108] If it has been collected, the value of the receiving counter is increased by one;

[0109] Determine whether the ID in a currently received CAN data frame is the same as the ID of the remote frame;

[0110] If they are the same, the value of the receiving counter is stored in the storage queue corresponding to the remote frame, and the remote frame collection flag and the value of the receiving counter are cleared.

[0111] Furthermore, after increasing the value of the receiving counter by one, the method further comprises:

[0112] If the value of the receiving counter exceeds a preset maximum waiting threshold, the value of the receiving counter is stored in a storage queue corresponding to the remote frame, and the remote frame collection flag and the value of the receiving counter are cleared.

[0113] Furthermore, after judging whether the remote frame has been collected according to the remote frame collection mark, the method further comprises:

[0114] If not, the detection node waits to receive the next frame of CAN data, and when the next frame of CAN data is received, continues to execute the step of determining whether the remote frame has been collected according to the remote frame collection mark.

[0115] Furthermore, after determining whether the ID in the currently received frame of CAN data is the same as the ID of the remote frame, the method further includes:

[0116] If they are not the same, the detection node waits to receive the next frame of CAN data, and when receiving the next frame of CAN data, continues to execute the step of determining whether the remote frame has been collected according to the remote frame collection mark.

[0117] Furthermore, the ratio of the number of count values ​​exceeding the preset comparison threshold in the storage queue corresponding to each remote frame to the total number of count values ​​in the storage queue is calculated respectively, and the first ratio corresponding to each remote frame is obtained as follows:

[0118] Counting the number of count values ​​exceeding a preset comparison threshold in a storage queue corresponding to a remote frame to obtain a first number;

[0119] Counting the total number of count values ​​in the storage queue corresponding to the remote frame to obtain a second number;

[0120] Divide the first number by the second number to obtain a first proportion corresponding to the remote frame.

[0121] Furthermore, the respectively determining whether the first proportion corresponding to each remote frame exceeds the calibration threshold corresponding to each remote frame, and adjusting the intrusion risk value according to the determination result is specifically:

[0122] If a first proportion corresponding to a remote frame exceeds a calibration threshold corresponding to the remote frame, a preset risk value is added to the intrusion risk value.

[0123] Furthermore, the analysis period is greater than the broadcast period.

[0124] In summary, the DOS attack detection method and storage medium for the vehicle CAN network provided by the present invention are more suitable for the current automotive field than traditional complex statistical models, and can effectively and quickly detect potential DOS attacks in the vehicle CAN network to avoid damage to personnel and vehicles; and have better effects in application scenarios with real-time requirements and limited ECU resources in the vehicle.

[0125] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A DOS attack detection method for a vehicle CAN network, characterized in that: The CAN bus of the vehicle CAN network is also provided with a detection node; the method comprises: Generate a remote frame set according to the CAN matrix table, wherein the ID of each remote frame in the remote frame set is respectively an ID preset in the CAN matrix table; The detection node cyclically obtains a remote frame from the remote frame set in sequence according to a preset broadcast period, and broadcasts the remote frame to the CAN bus; The detection node retrieves the remote frame; The detection node counts the number of other frames received between the time when the remote frame is retrieved and the time when the data frame corresponding to the remote frame is received, obtains a count value, and stores the count value in a storage queue corresponding to the remote frame; According to a preset analysis period, respectively calculate the ratio of the number of count values ​​exceeding a preset comparison threshold in the storage queue corresponding to each remote frame to the total number of count values ​​in the storage queue, to obtain a first ratio corresponding to each remote frame; respectively judging whether the first proportion corresponding to each remote frame exceeds the calibration threshold corresponding to each remote frame, and adjusting the intrusion risk value according to the judgment result; If the intrusion risk value exceeds the preset risk threshold, it is determined to be a DOS attack.

2. The DOS attack detection method for vehicle CAN network according to claim 1 is characterized in that: The detection node retrieves the remote frame specifically as follows: The detection node collects a frame of CAN data from the CAN bus; Determine whether the frame of CAN data is the remote frame; If yes, the remote frame acquisition flag is set to "acquired" and the value of the receiving counter is cleared; If not, continue to execute the step of the detection node collecting a frame of CAN data from the CAN bus.

3. The DOS attack detection method for vehicle CAN network according to claim 2 is characterized in that: The detection node counts the number of other frames received between the remote frame and the data frame corresponding to the remote frame, obtains a count value, and stores the count value in a storage queue corresponding to the remote frame, specifically: When the detection node receives a frame of CAN data from the CAN bus, it determines whether the remote frame has been collected according to the remote frame collection mark; If it has been collected, the value of the receiving counter is increased by one; Determine whether the ID in a currently received CAN data frame is the same as the ID of the remote frame; If they are the same, the value of the receiving counter is stored in the storage queue corresponding to the remote frame, and the remote frame collection flag and the value of the receiving counter are cleared.

4. The DOS attack detection method for vehicle CAN network according to claim 3 is characterized in that: After the value of the receiving counter is increased by one, the method further comprises: If the value of the receiving counter exceeds a preset maximum waiting threshold, the value of the receiving counter is stored in a storage queue corresponding to the remote frame, and the remote frame collection flag and the value of the receiving counter are cleared.

5. The DOS attack detection method for vehicle CAN network according to claim 3 is characterized in that: After judging whether the remote frame has been collected according to the remote frame collection mark, the method further comprises: If not, the detection node waits to receive the next frame of CAN data, and when the next frame of CAN data is received, continues to execute the step of determining whether the remote frame has been collected according to the remote frame collection mark.

6. The DOS attack detection method for vehicle CAN network according to claim 3 is characterized in that: After determining whether the ID in the currently received frame of CAN data is the same as the ID of the remote frame, the method further comprises: If they are not the same, the detection node waits to receive the next frame of CAN data, and when receiving the next frame of CAN data, continues to execute the step of determining whether the remote frame has been collected according to the remote frame collection mark.

7. The DOS attack detection method for vehicle CAN network according to claim 1 is characterized in that: The ratio of the number of count values ​​exceeding the preset comparison threshold in the storage queue corresponding to each remote frame to the total number of count values ​​in the storage queue is calculated respectively, and the first ratio corresponding to each remote frame is obtained as follows: Counting the number of count values ​​exceeding a preset comparison threshold in a storage queue corresponding to a remote frame to obtain a first number; Counting the total number of count values ​​in the storage queue corresponding to the remote frame to obtain a second number; Divide the first number by the second number to obtain a first proportion corresponding to the remote frame.

8. The DOS attack detection method for vehicle CAN network according to claim 1 is characterized in that: The respectively judging whether the first proportion corresponding to each remote frame exceeds the calibration threshold corresponding to each remote frame, and adjusting the intrusion risk value according to the judging result is specifically: If a first proportion corresponding to a remote frame exceeds a calibration threshold corresponding to the remote frame, a preset risk value is added to the intrusion risk value.

9. The DOS attack detection method for vehicle CAN network according to claim 1, characterized in that: The analysis period is greater than the broadcast period.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps according to any one of claims 1 to 9 are implemented.

Images