Vehicle information security protection method, device, system and equipment

Abstract

The present application discloses a vehicle information security protection method, device, system and equipment, wherein the method includes: obtaining the first cluster center of different data clusters from the cloud, wherein the different data clusters include attack clusters and security clusters; calculating the similarity between the data to be identified and each of the first cluster centers, and judging whether the data to be identified is attack data based on the similarity calculation result; if so, blocking the input source of the data to be identified and giving an alarm; if not, responding to the data to be identified. The above scheme has high real-time recognition and recognition rate, and as the number of attack types increases, the cloud can only add clusters corresponding to the newly added types on the basis of the existing architecture and algorithm. Compared with the existing technology, there is no need to restructure the new model, thus solving the problem of long development cycle and high development difficulty in the existing technology.

Description

Technical Field

[0001] The present application generally relates to the field of vehicle information security technology, and specifically relates to a vehicle information security protection method, device, system and equipment. Background Art

[0002] With the advancement of technology, vehicle networking, intelligence and autonomous driving functions are becoming more and more popular. As a result, the number and types of cyber attacks that vehicles may suffer are also increasing.

[0003] In order to deal with the threat of cyber attacks, the existing practice is to deploy neural network models and other algorithms on vehicles to identify and protect against cyber attacks. However, neural network models consume a lot of controller resources, while vehicle controller resources are relatively limited, which affects the processing speed of the neural network model, resulting in low real-time recognition and recognition rate. In addition, due to the limitations of the neural network model's own architecture, if the type of cyber attack changes later, it is difficult to adapt to the new type of cyber attack by modifying the architecture of the neural network model, and a new neural network model needs to be restructured, which leads to problems such as long development cycle and high development difficulty. Summary of the invention

[0004] In view of the problems existing in the prior art, the present application proposes a vehicle information security protection method, device, system and equipment to solve the problems in the prior art, such as low real-time recognition and recognition rate, and the need to re-structure a new neural network model in response to changes in the type of network attacks, resulting in a long development cycle and high development difficulty.

[0005] In a first aspect, an embodiment of the present application provides a vehicle information security protection method, including:

[0006] Acquire first cluster centers of different data clusters from the cloud, where the different data clusters include attack clusters and security clusters;

[0007] Calculating similarity between the data to be identified and each of the first cluster centers, and judging whether the data to be identified is attack data according to the similarity calculation result;

[0008] If yes, the input source of the data to be identified is blocked and an alarm is issued;

[0009] If not, respond with the data to be identified.

[0010] As an implementable manner, the similarity calculation is performed based on the distance between the data to be identified and each of the first cluster centers.

[0011] As an implementable manner, when the data to be identified is attack data, a black hole measure and / or a honeypot measure is performed on the data to be identified.

[0012] As possible implementation methods, it also includes:

[0013] Sending the data to be identified to the cloud, so that the cloud updates the corresponding data clustering, and obtaining a second clustering center based on the updated data clustering calculation;

[0014] The second cluster center is obtained to replace the locally corresponding first cluster center.

[0015] In a second aspect, the present invention provides a vehicle information security protection device, comprising:

[0016] A data acquisition and forwarding unit, at least used to acquire a first cluster center of different data clusters from the cloud, wherein the different data clusters include an attack cluster and a security cluster;

[0017] An information security identification unit is connected to the data acquisition and forwarding unit, and is used to obtain the data to be identified and each of the first cluster centers from the data acquisition and forwarding unit, and calculate the similarity between the data to be identified and each of the first cluster centers, and judge whether the data to be identified is attack data based on the similarity calculation result. If so, control the data acquisition and forwarding unit to block the input source of the data to be identified and issue an alarm; if not, respond to the data to be identified.

[0018] As an implementable manner, the information security identification unit includes: a similarity calculation module and a data type judgment module;

[0019] The similarity calculation module is connected to the data acquisition and forwarding unit, and is used to obtain the data to be identified and each of the first cluster centers from the data acquisition and forwarding unit, and perform the similarity calculation according to the distance between the data to be identified and each of the first cluster centers;

[0020] The data type judgment module is connected to the similarity calculation module and is used to judge whether the data to be identified is attack data based on the similarity calculation result. If so, the data acquisition forwarding unit is controlled to block the input source of the data to be identified and issue an alarm; if not, the data to be identified is responded to.

[0021] As an implementable method, the data acquisition and forwarding unit is also used to send the data to be identified to the cloud so that the cloud can update the corresponding data clustering, and obtain a second clustering center based on the updated data clustering calculation; obtain the second clustering center from the cloud and send it to the similarity calculation module to replace the corresponding first clustering center in the similarity calculation module.

[0022] As possible implementation methods, it also includes:

[0023] A data processing unit is connected to the data acquisition and forwarding unit, and is used to execute black hole measures and / or honeypot measures on the data to be identified when the data to be identified is attack data.

[0024] In a third aspect, the present invention provides a vehicle information security protection system, comprising a cloud and the above-mentioned vehicle information security protection device;

[0025] The cloud is used to cluster existing data into a predetermined number of different data clusters and calculate a first cluster center of each data cluster, wherein the different data clusters include attack clusters and security clusters.

[0026] As an implementable manner, the cloud is further used to receive the data to be identified, so as to update the corresponding data clustering, and obtain a second cluster center based on the updated data clustering calculation.

[0027] As an implementable method, it is determined whether the absolute value of the difference between the second cluster center and the existing corresponding first cluster center exceeds the update threshold. If so, the second cluster center is sent to the vehicle information security protection device so that the vehicle information security protection device can replace the corresponding first cluster center.

[0028] In a fourth aspect, the present invention provides an electronic device, comprising:

[0029] One or more processors;

[0030] A memory for storing one or more programs;

[0031] When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the above-mentioned method.

[0032] The above scheme provided by the embodiment of the present application only needs to calculate the similarity between the data to be identified and each first clustering center at the vehicle end to determine whether the data to be identified is attack data, which has the advantage of small calculation amount and can improve the real-time performance of identification; in addition, since the computing power of the cloud is relatively strong, a large amount of data can be clustered in the cloud and the corresponding first clustering center can be obtained more accurately. The recognition rate of using the first clustering center to perform similarity calculation on the data to be identified to determine whether it is attack data is high. In addition, the type of clustering can be determined as needed. For example, as the number of attack types increases, the cloud can only add clusters corresponding to the newly added types on the basis of the existing architecture and algorithm. Compared with the existing technology, there is no need to restructure the new model, thus solving the problem of long development cycle and high development difficulty in the existing technology. On the other hand, since the vehicle end only uses the first clustering center calculated by the cloud end to identify whether the data to be identified is offensive or not, and the data to be identified is also the data received and transmitted by the vehicle end, it will not affect or attack the clustering operation of the cloud end, so it is more secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or prior art descriptions. Obviously, the drawings are only used to illustrate the preferred implementation methods and are not considered to be limitations of the present application. It should also be noted that, for the convenience of description, only the relevant parts of the present application are shown in the drawings, not all.

[0034] Figure 1 It is an implementation environment architecture diagram of a vehicle information security protection method according to an embodiment of the present application;

[0035] Figure 2 is a flow chart of data clustering and obtaining the first cluster center according to an embodiment of the present application;

[0036] Figure 3 It is a flow chart of a vehicle information security protection method according to an embodiment of the present application;

[0037] Figure 4 is a flowchart of obtaining a second cluster center according to an embodiment of the present application;

[0038] Figure 5 is a structural schematic diagram of a vehicle information security protection device according to an embodiment of the present application;

[0039] Figure 6 is a structural schematic diagram of a vehicle information security protection device according to another embodiment of the present application;

[0040] Figure 7 is a structural schematic diagram of a vehicle information security protection device according to another embodiment of the present application;

[0041] Figure 8 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0042] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant contents of the present application, rather than to limit the application. It is also necessary to explain that, for ease of description, only the parts related to the application are shown in the accompanying drawings.

[0043] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0044] Figure 1 FIG. 1 is a diagram of an implementation environment of a vehicle information security protection method according to an embodiment of the present application. Figure 1 As shown, the implementation environment architecture includes: a cloud 1 and at least one vehicle 2, and each vehicle 2 is provided with a vehicle information security protection device 3. Figure 1 Three vehicles 2 are shown as an example. In actual use, the number is determined according to the specific situation. Each vehicle 2 can independently interact with the cloud 1. The data interaction can be carried out in a wired communication mode or a wireless communication mode.

[0045] The cloud 1 is deployed with a clustering model and a large amount of existing data. The clustering model is used to cluster the existing data into a predetermined number of data clusters, and the first cluster center of each data cluster is calculated respectively.

[0046] For example, there are six common attacks, namely S (Spoofing), T (Tampering), R (Repudiation), I (Information Disclosure), D (Denial of Service), and E (Elevation of Privilege). Then seven data clusters can be used. Each of the above six attacks corresponds to a data cluster, namely S data cluster, T data cluster, R data cluster, I data cluster, D data cluster, and E data cluster; the remaining one is used as a data cluster without attack. Of course, according to the different types of attacks and the increase in the number of attack types, the type and number of data clusters can be adjusted accordingly to improve the flexibility of deployment and the convenience of subsequent upgrades.

[0047] The clustering model may be, but is not limited to, a K-Means clustering model, a mean shift clustering model, a density-based clustering model, a Gaussian mixture clustering model, an agglomerative hierarchical clustering model, and a graph group detection clustering model, etc. The K-Means clustering model will be used as an example for illustration below.

[0048] Each existing data may include multiple data items, and the data item may be at least any one of a data type, a data value, a data transmission time, a data end point, a transmission number, and the like.

[0049] When a large amount of existing data is clustered into seven data clusters using the K-Means clustering model, the large amount of existing data is called a data set, which is represented by A = (A1, A2, ... A k ,…A n ), where A k (k=1,2,3…,n) represents a data in the data set. Each data cluster is called a cluster. The n data in the data set can be clustered into seven clusters, represented by B=(B1,B2,…B i ,…B7), where (i=1,2,3…,7); clustering calculation is performed through the following relationship, and the data similarity within each cluster is maximized and the data similarity between different clusters is minimized:

[0050]

[0051] Among them, a represents a data in data set A, b i represents a cluster center. The initial cluster center can be manually selected based on expert experience to improve accuracy. i ) represents the distance between point a and the cluster center, H represents B i All data objects and corresponding cluster centers b i The sum of squared Euclidean distances between them. When H can converge, it means that the clustering effect is the best, that is, the clustering of a large amount of existing data is completed, and seven different data clusters are formed.

[0052] During the clustering process, each time the data cluster changes (for example, but not limited to, new data is added to the data cluster), the cluster center is updated once using the following relationship, and the cluster center when the clustering is finally completed is used as the first cluster center:

[0053]

[0054] Among them, m i (b i) is the updated cluster center (that is, the average value of each data object). Each time the cluster center is updated, the above H is calculated again until convergence.

[0055] like Figure 2 As shown, the specific process of obtaining the above data clustering and the first cluster center can be expressed as:

[0056] S101: Acquire multiple existing data;

[0057] S102: Manually select 7 original cluster centers based on expert experience;

[0058] S103: calculation of the sum of squared Euclidean distances H;

[0059] S104: Determine the data cluster to which the corresponding data belongs according to H;

[0060] S105: assigning corresponding data to the data cluster to which it belongs;

[0061] S106: Calculate cluster center m i (b i ), and determine whether it converges, if not, execute again from S103, if yes, execute S107;

[0062] S107: Obtain data clustering and the corresponding first cluster center.

[0063] After the cloud clustering is completed, the first cluster center will be sent to the vehicle so that the vehicle information security protection device of the vehicle can identify whether the data to be identified is attack data based on the first cluster center obtained by cloud calculation.

[0064] Figure 3 It is a flow chart of a vehicle information security protection method according to an embodiment of the present application. Figure 3 The method shown can be Figure 1 The vehicle information security protection device of the vehicle is executed, such as Figure 3 As shown, the vehicle information security protection method includes:

[0065] S201: Obtaining first cluster centers of different data clusters from the cloud, where the different data clusters include attack clusters and security clusters;

[0066] As described above, in this example, seven first cluster centers are obtained from the cloud, and each first cluster center corresponds to a data cluster. Among them, the attack clusters include S data clusters, T data clusters, R data clusters, I data clusters, D data clusters, and E data clusters; of course, in other examples, there may also be other numbers or types of attack clusters.

[0067] S202: Calculating similarity between the data to be identified and each of the first cluster centers, and determining whether the data to be identified is attack data according to the similarity calculation result;

[0068] The data to be identified can be data being transmitted within the vehicle or external data received by the vehicle.

[0069] For example, but not limited to, the distance between the data to be identified and each first cluster center can be calculated by the Euclidean distance formula to determine the similarity between the data to be identified and each first cluster center. The smaller the distance between the data to be identified and the first cluster center, the higher the similarity between the two. According to the similarity, it can be judged whether the data to be identified is attack data and what kind of attack data it is. For example, if the similarity between the data to be identified and the first cluster center of the S data cluster is the highest, then the data to be identified is the attack data corresponding to the S data cluster. Similarly, it can be judged whether the data to be identified is the attack data corresponding to other data clusters or the data corresponding to the security cluster.

[0070] S203: If yes, blocking the input source of the data to be identified and giving an alarm;

[0071] For example, but not limited to, when the data to be identified is determined to be attack data, the input source of the data to be identified can be blocked by disconnecting the link connected to the input source of the data to be identified through a router, so that the data of the input source cannot continue to attack. The alarm can be given by voice prompts, buzzers, and graphic prompts displayed on the vehicle display terminal.

[0072] S204: If not, respond to the data to be identified.

[0073] If the data to be identified is normal, the data to be identified is responded to. For example, if the data to be identified is a throttle opening increase request, the throttle opening increase request is responded to and the throttle opening is increased according to the amount of throttle increase required in the throttle opening increase request.

[0074] The above scheme provided by the embodiment of the present application only needs to calculate the similarity between the data to be identified and each first clustering center at the vehicle end to determine whether the data to be identified is attack data. It has the advantage of small calculation amount and is suitable for the limited data processing resources at the vehicle end. It can improve the real-time performance of identification. In addition, since the computing power of the cloud is relatively strong, a large amount of data can be clustered in the cloud and the corresponding first clustering center can be obtained more accurately. The recognition rate of using the first clustering center to perform similarity calculation on the data to be identified to determine whether it is attack data is high. In addition, the type of clustering can be determined as needed. For example, as the number of attack types increases, the cloud can only add clusters corresponding to the newly added types on the basis of the existing architecture and algorithm. Compared with the existing technology, there is no need to restructure the new model, thus solving the problem of long development cycle and high development difficulty in the existing technology. On the other hand, since the vehicle end only uses the first clustering center calculated by the cloud end to identify whether the data to be identified is only offensive or not, and the data to be identified is also the data received and transmitted by the vehicle end, it will not affect or attack the clustering operation of the cloud end, so it is more secure.

[0075] As an implementable manner, the similarity calculation is performed based on the distance between the data to be identified and each of the first cluster centers.

[0076] For example but not limited to, the distance between the data to be identified and each first cluster center can be calculated by the Euclidean distance formula, and the distance is used to represent the similarity. The smaller the distance, the higher the similarity, and vice versa.

[0077] As an implementable manner, when the data to be identified is attack data, a black hole measure and / or a honeypot measure is performed on the data to be identified.

[0078] In order to prevent the unidentified data judged as attack data from causing adverse effects, black hole measures or honeypot measures are executed. Of course, black hole measures and honeypot measures can also be executed; which specific measures to execute can be determined based on actual conditions.

[0079] Among them, the black hole measure refers to the use of hardware such as internal registers to import attack data into the black hole, so that no matter what information the attacker sends, it cannot trigger any mechanism of the controller. The honeypot measure refers to the use of internal registers to implement a simulated vulnerable controller system or service, luring attackers to continuously obtain invalid information, and then record and trace the attacker through logs and other means to obtain the attacker's information.

[0080] As an implementable manner, in order to achieve the purpose of self-learning and update the local first cluster center to improve the protection capability, the vehicle information security protection method further includes:

[0081] Sending the data to be identified to the cloud, so that the cloud updates the corresponding data clustering, and obtaining a second clustering center based on the updated data clustering calculation;

[0082] After the data to be identified is sent to the cloud, the data set in the cloud becomes A'= (A1', A2', ... A x '), where (x=1,2,3…,m); the cloud determines which cluster (i.e., which cluster) the data to be identified belongs to according to the following relationship:

[0083]

[0084] The data cluster to which it belongs is determined by the minimum value of h relative to each data cluster, and the data to be identified is assigned to the corresponding data cluster. Then, the cluster center of the data cluster is calculated according to the following relationship until convergence, and the converged cluster center is called the second cluster center:

[0085]

[0086] like Figure 4 As shown, the specific process of obtaining the second cluster center can be expressed as:

[0087] S301: The cloud obtains data to be identified; the data of the cloud data set A' includes A and the data to be identified, that is, S301 can be carried out in conjunction with the above S107 to achieve self-learning of cloud data clustering;

[0088] S302: Calculation of the sum of squares of the Euclidean distance h;

[0089] S303: Determine the data cluster to which the data to be identified belongs according to h;

[0090] S304: Allocate the data to be identified to the corresponding data cluster;

[0091] S305: Calculate cluster center m i (b i '), and determine whether it converges, if not, execute again from S302, if yes, execute S306;

[0092] S306: Obtain updated data clusters and corresponding second cluster centers.

[0093] The second cluster center is obtained to replace the locally corresponding first cluster center.

[0094] The first cluster center may be updated in real time or at a scheduled time, or updated only when the change in the second cluster center reaches a certain amount. In subsequent examples, the first cluster center is updated only when the change in the second cluster center reaches a certain amount.

[0095] Second, as Figure 5 As shown, the present invention provides a vehicle information security protection device, comprising:

[0096] A data acquisition and forwarding unit 31 is at least used to acquire a first cluster center of different data clusters from the cloud, where the different data clusters include attack clusters and security clusters;

[0097] The data acquisition and forwarding unit 31 is, for example but not limited to, a router.

[0098] The information security identification unit 32 is connected to the data acquisition and forwarding unit, and is used to obtain the data to be identified and each of the first cluster centers from the data acquisition and forwarding unit, and calculate the similarity between the data to be identified and each of the first cluster centers, and judge whether the data to be identified is attack data based on the similarity calculation result. If so, the data acquisition and forwarding unit is controlled to block the input source of the data to be identified and issue an alarm; if not, the data to be identified is responded to.

[0099] The vehicle information security protection device is used to implement the above-mentioned vehicle information security protection method. Its working principle and effect refer to the above-mentioned method embodiment, which will not be repeated here.

[0100] As an achievable method, Figure 6 As shown, the information security identification unit 32 includes: a similarity calculation module 321 and a data type judgment module 322; the similarity calculation module 321 and the data type judgment module 322 can be two independent hardwares, for example, the similarity calculation module 321 can be an FPGA (Field Programmable Gate Array), and the data type judgment module 322 can be an MCU (Micro Controller Unit). The information security identification unit 32 uses two different hardwares and respectively implements the following different functions, thereby achieving the purpose of hardware isolation and improving security performance.

[0101] The similarity calculation module 321 is connected to the data acquisition and forwarding unit 31, and is used to obtain the data to be identified and each of the first cluster centers from the data acquisition and forwarding unit 31, and perform the similarity calculation according to the distance between the data to be identified and each of the first cluster centers;

[0102] The data type determination module 322 is connected to the similarity calculation module 321, and is used to determine whether the data to be identified is attack data based on the similarity calculation result. If so, the data acquisition forwarding unit 31 is controlled to block the input source of the data to be identified and issue an alarm; if not, the data to be identified is responded to.

[0103] As an implementable method, the data acquisition forwarding unit 31 is also used to send the data to be identified to the cloud 1 so that the cloud 1 can update the corresponding data clustering, and obtain a second clustering center based on the updated data clustering calculation; obtain the second clustering center from the cloud 1 and send it to the similarity calculation module to replace the corresponding first clustering center in the similarity calculation module.

[0104] As an implementable manner, the vehicle information security protection device further includes:

[0105] The data processing unit 33 is connected to the data acquisition and forwarding unit 31, and is used to execute black hole measures and / or honeypot measures on the data to be identified when the data to be identified is attack data.

[0106] For example, the data acquisition and forwarding unit 31 is a router, the data type determination module 322 is an MCU, and when the data to be identified is attack data, the MCU controls the router to route the data to be identified to the data processing unit 33 .

[0107] Third, see also Figure 1 ,The present invention provides a vehicle information security protection system, including a cloud ,1 and the above-mentioned vehicle information security protection device 3;

[0108] The cloud 1 is used to cluster existing data into a predetermined number of different data clusters and calculate a first cluster center of each data cluster. The different data clusters include attack clusters and security clusters.

[0109] As an implementable manner, the cloud 1 is further used to receive the data to be identified, so as to update the corresponding data clustering, and obtain a second cluster center based on the updated data clustering calculation.

[0110] As an implementable method, it is determined whether the absolute value of the difference between the second cluster center and the existing corresponding first cluster center exceeds the update threshold. If so, the second cluster center is sent to the vehicle information security protection device so that the vehicle information security protection device 3 can replace the corresponding first cluster center.

[0111] In a fourth aspect, the present invention provides an electronic device, comprising:

[0112] One or more processors;

[0113] A memory for storing one or more programs;

[0114] When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the above-mentioned method.

[0115] The embodiments in this specification are described in a progressive manner, and similar parts between the various embodiments refer to each other. The embodiments under each step focus on the specific method under that step. The above-described implementation scheme is merely illustrative, and the specific embodiments are only examples for illustrating the present application. Technicians in the technical field to which the present application belongs can also make several improvements and polishing without departing from the principles described in the embodiments of the present application, and these improvements should also be regarded as the scope of protection of the present application.

[0116] Alternatively, if Figure 8 As shown, a structural schematic diagram of an electronic device serving as a vehicle information security protection device is provided. The vehicle information security protection device provided in an embodiment of the present application includes a processor and a memory, wherein the memory is configured to store one or more programs; the processor is configured to execute the program to implement the method described in the above embodiment.

[0117] The one or more programs are stored in a program in a read-only memory ROM or a program in a random access memory RAM to perform various appropriate actions and processes. The random access memory RAM includes a software program that can implement the method described in the above embodiment in real time. The processor and the read-only memory ROM and random access memory RAM can be connected to each other through a bus, and various input / output interfaces can also be connected to the bus.

[0118] The following components are connected to the input / output interface, such as a display device and an output portion of a speaker and the like. The onboard controller may also be a communication portion of a network interface card. The communication portion performs communication processing via a network such as the Internet. The memory may be a removable medium such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., which is installed on a drive as needed so that a computer program read therefrom is installed into the memory as needed.

[0119] According to an embodiment of the present disclosure, the vehicle information security protection method described in any of the above embodiments can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes a program code for executing the vehicle information security protection method. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part, and / or installed from a removable medium.

[0120] In one embodiment, the processor may be configured to include:

[0121] A data acquisition and forwarding unit, at least used to acquire a first cluster center of different data clusters from the cloud, wherein the different data clusters include an attack cluster and a security cluster;

[0122] An information security identification unit is connected to the data acquisition and forwarding unit, and is used to obtain the data to be identified and each of the first cluster centers from the data acquisition and forwarding unit, and calculate the similarity between the data to be identified and each of the first cluster centers, and judge whether the data to be identified is attack data based on the similarity calculation result. If so, control the data acquisition and forwarding unit to block the input source of the data to be identified and issue an alarm; if not, respond to the data to be identified.

[0123] In particular, the process described in each flowchart according to the embodiment of the present application can be implemented as a computer software program. For example, each method embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through a communication part, and / or installed from a removable medium. When the computer program is executed by a central processing unit (CPU), the above-mentioned functions defined in the device of the present application are executed.

[0124] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0125] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of the boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0126] The units involved in the embodiments described in the present application may be implemented by software or hardware, and the units described may also be provided in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves. The units or modules described may also be provided in a processor, for example, may be described as: a processor includes a similarity calculation module, a data type determination module, etc. The names of these units or modules do not, in some cases, constitute limitations on the units or modules themselves.

[0127] It should be noted that although several modules or units of the vehicle information safety protection device are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0128] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0129] Through the description of the above implementations, those skilled in the art can easily understand that the example implementations described here can be implemented by software, or by combining software with necessary hardware.

[0130] The above are only preferred embodiments of the present application and descriptions of the technical principles used. Those skilled in the art should understand that the scope of application involved in the present application is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above application concept. For example, the above features are replaced with (but not limited to) technical features with similar functions disclosed in the present application.

Claims

1. A vehicle information security protection method, characterized in that: include: Acquire first cluster centers of different data clusters from the cloud, where the different data clusters include attack clusters and security clusters; Calculate similarity between the data to be identified and each of the first cluster centers, send the data to be identified to the cloud, so that the cloud can update the corresponding data cluster, and obtain the second cluster center based on the updated data cluster calculation; obtain the second cluster center to replace the corresponding first cluster center locally, and determine whether the data to be identified is attack data according to the similarity calculation result; If yes, the input source of the data to be identified is blocked and an alarm is issued; If not, respond with the data to be identified.

2. The vehicle information security protection method according to claim 1, characterized in that: The similarity calculation is performed based on the distance between the data to be identified and each of the first cluster centers.

3. The vehicle information security protection method according to claim 1, characterized in that: When the data to be identified is attack data, a black hole measure and / or a honeypot measure is performed on the data to be identified.

4. A vehicle information security protection device, characterized in that: include: A data acquisition and forwarding unit, at least used to acquire first cluster centers of different data clusters from the cloud, wherein the different data clusters include attack clusters and security clusters, and to send the data to be identified to the cloud so that the cloud updates the corresponding data clusters, and obtains a second cluster center based on the updated data cluster calculation; acquires the second cluster center from the cloud and sends it to a similarity calculation module to replace the corresponding first cluster center in the similarity calculation module; An information security identification unit is connected to the data acquisition and forwarding unit, and is used to obtain the data to be identified and each of the first cluster centers from the data acquisition and forwarding unit, and calculate the similarity between the data to be identified and each of the first cluster centers, and judge whether the data to be identified is attack data based on the similarity calculation result. If so, control the data acquisition and forwarding unit to block the input source of the data to be identified and issue an alarm; if not, respond to the data to be identified.

5. The vehicle information security protection device according to claim 4, characterized in that: The information security identification unit includes: a similarity calculation module and a data type judgment module; The similarity calculation module is connected to the data acquisition and forwarding unit, and is used to obtain the data to be identified and each of the first cluster centers from the data acquisition and forwarding unit, and perform the similarity calculation according to the distance between the data to be identified and each of the first cluster centers; The data type judgment module is connected to the similarity calculation module, and is used to judge whether the data to be identified is attack data based on the similarity calculation result. If so, the data acquisition forwarding unit is controlled to block the input source of the data to be identified and issue an alarm; if not, the data to be identified is responded to.

6. The vehicle information security protection device according to claim 4, characterized in that: Also includes: A data processing unit is connected to the data acquisition and forwarding unit, and is used to execute black hole measures and / or honeypot measures on the data to be identified when the data to be identified is attack data.

7. A vehicle information security protection system, characterized in that: Comprising a cloud and a vehicle information security protection device as described in any one of claims 4 to 6; The cloud is used to cluster the existing data into a predetermined number of different data clusters, to receive the data to be identified, to update the corresponding data clusters, and to calculate and obtain a second cluster center based on the updated data clusters; And the first cluster center of each data cluster is calculated, and the different data clusters include attack clusters and security clusters.

8. The vehicle information security protection system according to claim 7, characterized in that: Determine whether the absolute value of the difference between the second cluster center and the existing corresponding first cluster center exceeds an update threshold. If so, send the second cluster center to the vehicle information security protection device so that the vehicle information security protection device can replace the corresponding first cluster center.

9. An electronic device, characterized in that: include: One or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 3.

Images