An information processing method, system, storage medium and electronic device

Abstract

Embodiments of the present application provide an information processing method, system, storage medium and electronic device. The method is applied to an electronic control unit, the electronic control unit analyzes vehicle network intrusion information, obtains the information type of the vehicle network intrusion information, determines the intrusion event similarity corresponding to the information type, determines the information filtering mode based on the intrusion event similarity, filters multiple vehicle network intrusion information of the same information type based on the information filtering mode, and sends at least part of the filtered vehicle network intrusion information to the cloud. The present application can reduce the amount of network intrusion information by filtering the vehicle network intrusion information, and avoid the problem of network paralysis caused by a large amount of network intrusion information.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to an information processing method, system, storage medium, and electronic device. Background Technology

[0002] Intrusion Detection Systems (IDS) can detect CAN (Controller Area Network) messages transmitted through vehicle networks. IDS generates a large amount of network intrusion information after detection, and uploading this information to the cloud can cause network outages. Therefore, it is essential to know how to process network intrusion information to reduce the volume of data. Summary of the Invention

[0003] The purpose of this invention is to provide an information processing method, system, storage medium, and electronic device that can reduce the amount of network intrusion information and avoid network paralysis caused by a large amount of network intrusion information. The specific technical solution is as follows:

[0004] This invention provides an information processing method applied to an electronic control unit, the method comprising:

[0005] The electronic control unit parses the vehicle network intrusion information to obtain the information type of the vehicle network intrusion information;

[0006] The electronic control unit determines the similarity of intrusion events corresponding to the information type, and determines an information filtering method based on the intrusion event similarity; the intrusion event similarity is either different intrusion events or the same intrusion events, and the intrusion event is an event in which the electronic control unit is attacked. When the intrusion event occurs, the vehicle network intrusion information is generated; when the intrusion events are different, a first filtering method is used, which is a filtering method that uses sampling points to filter the vehicle network intrusion information; when the intrusion events are the same, a second filtering method is used, which is a filtering method that selects at least one piece of vehicle network intrusion information within a preset time period.

[0007] The electronic control unit filters multiple vehicle network intrusion messages of the same information type based on the information filtering method, and sends at least a portion of the filtered vehicle network intrusion messages to the cloud.

[0008] Optionally, the intrusion event similarity can be defined as either different intrusion events or the same intrusion events;

[0009] The electronic control unit determines the similarity of the intrusion event corresponding to the information type, and determines the information filtering method based on the similarity of the intrusion event, including:

[0010] If the information type is message identifier abnormal, the electronic control unit determines that the similarity of the intrusion event corresponding to the information type is different from the intrusion event, and determines that the information filtering method is the first filtering method;

[0011] If the information type is message period abnormal, the electronic control unit determines that the similarity of the intrusion event corresponding to the information type is the same as the intrusion event, and determines that the information filtering method is the second filtering method.

[0012] Optionally, the intrusion event similarity can be defined as either different intrusion events or the same intrusion events;

[0013] The electronic control unit determines the similarity of the intrusion event corresponding to the information type, and determines the information filtering method based on the similarity of the intrusion event, including:

[0014] If the information type is message identifier abnormal and the difference in the number of intrusion events occurring within multiple uniform time periods is less than a preset difference, then the electronic control unit determines that the similarity of the intrusion event corresponding to the information type is different from the intrusion event, and determines that the information filtering method is the first filtering method.

[0015] If the information type is message identifier abnormal and the difference in the number of intrusion events occurring within multiple uniform time periods is not less than a preset difference, then the electronic control unit determines that the similarity of the intrusion event corresponding to the information type is different from the intrusion event, and determines that the information filtering method is the first filtering method and the second filtering method, wherein the filtering order of the first filtering method is earlier than that of the second filtering method.

[0016] If the information type is message period abnormal, the electronic control unit determines that the similarity of the intrusion event corresponding to the information type is the same as the intrusion event, and determines that the information filtering method is the second filtering method.

[0017] Optionally, if the information type is message identifier abnormal, indicating that there are many types of message identifiers, the first filtering method used is a forwarding filtering method. The forwarding filtering method filters the vehicle network intrusion information at the preset sampling point by setting a sampling point interval, and discards the remaining vehicle network intrusion information.

[0018] If the information type is message period abnormality, and the message periods indicating abnormality are the same, the second filtering method used is the aggregation filtering method. The aggregation filtering method filters the vehicle network intrusion information with the first or last message period abnormality within the aggregation time period by setting an aggregation time period, retains the number of vehicle network intrusion information within the aggregation time period, and discards the remaining vehicle network intrusion information.

[0019] Optionally, the electronic control unit filters multiple vehicle network intrusion messages of the same information type based on the information filtering method, and sends at least a portion of the filtered vehicle network intrusion messages to the cloud, including:

[0020] From multiple vehicle network intrusion information of the same information type, obtain vehicle network intrusion information at a preset sampling point, and send the vehicle network intrusion information at the preset sampling point to the cloud.

[0021] Optionally, the electronic control unit filters multiple vehicle network intrusion messages of the same information type based on the information filtering method, and sends at least a portion of the filtered vehicle network intrusion messages to the cloud, including:

[0022] From multiple vehicle network intrusion messages within a preset time period, select the vehicle network intrusion message located at the endpoint to obtain the filtered vehicle network intrusion message;

[0023] The filtered vehicle network intrusion information is parsed to obtain the timestamp of the intrusion event and intrusion proof information;

[0024] The timestamp, the intrusion proof information, and the number of vehicle network intrusion messages within a preset time period are sent to the cloud.

[0025] Optionally, sending at least a portion of the filtered vehicle network intrusion information to the cloud includes:

[0026] If the amount of data to be sent is not less than a preset amount of data, the information to be sent is sent to the cloud; the information to be sent is at least a portion of the filtered vehicle network intrusion information that has not been sent to the cloud.

[0027] or,

[0028] According to a preset sending period, at least a portion of the filtered vehicle network intrusion information obtained within the sending period is sent to the cloud.

[0029] The present invention also provides an information processing system applied to an electronic control unit, the system comprising:

[0030] The information type determination module is configured to parse the vehicle network intrusion information by the electronic control unit to obtain the information type of the vehicle network intrusion information;

[0031] The filtering method determination module is configured to: determine the similarity of intrusion events corresponding to the information type for the electronic control unit; and determine the information filtering method based on the intrusion event similarity; the intrusion event similarity is either different or the same, and the intrusion event is an event in which the electronic control unit is attacked; in the event of the intrusion event, the vehicle network intrusion information is generated; in the case of different intrusion events, a first filtering method is adopted, which is a filtering method that uses sampling points to filter the vehicle network intrusion information; in the case of the same intrusion events, a second filtering method is adopted, which is a filtering method that selects at least one piece of the vehicle network intrusion information within a preset time period.

[0032] The information filtering module is configured to allow the electronic control unit to filter multiple vehicle network intrusion messages of the same information type based on the information filtering method, and to send at least a portion of the filtered vehicle network intrusion messages to the cloud.

[0033] The present invention also provides a computer-readable storage medium storing a program that, when executed by a processor, implements the above-described information processing method.

[0034] The present invention also provides an electronic device, comprising:

[0035] At least one processor, and at least one memory and bus connected to the processor;

[0036] The processor and the memory communicate with each other through the bus; the processor is used to call program instructions in the memory to execute the above-described information processing method.

[0037] This invention provides an information processing method, system, storage medium, and electronic device. An electronic control unit parses vehicle network intrusion information to obtain the information type; determines an information filtering method corresponding to the information type; filters multiple vehicle network intrusion messages of the same information type based on the information filtering method; and sends at least a portion of the filtered vehicle network intrusion information to the cloud. This invention reduces the amount of network intrusion information by filtering vehicle network intrusion information, avoiding network paralysis caused by a large amount of network intrusion information.

[0038] Of course, any product or method implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 A flowchart of an information processing method provided in an embodiment of the present invention;

[0041] Figure 2 This is a structural diagram of an information processing system provided in an embodiment of the present invention;

[0042] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] This invention provides an information processing method applied to electronic control units, such as... Figure 1 As shown, the method includes:

[0045] Step 101: The electronic control unit analyzes the vehicle network intrusion information to obtain the information type of the vehicle network intrusion information.

[0046] When a vehicle's network is connected to the internet, it is exposed to the internet, allowing for remote intrusion into the vehicle's ECUs. When a large number of CAN messages attack the ECU, the Intrusion Detection System (IDS) can detect the intrusion. This intrusion information can carry message identifiers, message cycles, message channel numbers, and CAN channel load rates. It can also carry a timestamp of the intrusion event. The information type can include abnormal message identifiers, abnormal message cycles, abnormal message channel numbers, and excessively high CAN channel load rates.

[0047] A message identifier error can be a CANID error. For example, if the expected CANID of the message is 0x100 or 0x200, and the CANID parsed from the vehicle network intrusion information is 0x300, then the information type of the vehicle network intrusion information is a message identifier error, i.e., a CANID error.

[0048] Step 102: The electronic control unit (ECU) determines the similarity of intrusion events corresponding to the information type, and determines the information filtering method based on the intrusion event similarity. Intrusion event similarity is defined as either different or identical intrusion events. An intrusion event is an event in which the ECU is attacked, generating vehicle network intrusion information. If the intrusion events are different, a first filtering method is used, which filters vehicle network intrusion information using sampling points. If the intrusion events are identical, a second filtering method is used, which selects at least one vehicle network intrusion information within a preset time period.

[0049] To avoid network paralysis caused by a large amount of network intrusion information, load balancing can be used to reduce the amount of network intrusion information through information filtering.

[0050] Multiple intrusion events of the same information type can occur. These events can be identical or different. When an intrusion event occurs, the intrusion detection system will detect the vehicular network intrusion information. Intrusion events of the same type will generate the same intrusion proof information, while intrusion events of different types will generate different intrusion proof information. For example, if the information type is "abnormal message identifier," there can be different types of intrusion events corresponding to this information type; that is, different intrusion events carry different message identifiers, and different message identifiers correspond to different intrusion events. As another example, if the information type is "abnormal message cycle," intrusion events of this type can be of the same type; that is, different intrusion events have the same message cycle, and the same message cycle corresponds to the same intrusion event.

[0051] The similarity of intrusion events is defined as either different or the same. When filtering information, the filtering method used for the same intrusion event can be different from the filtering method used for different intrusion events, so as to filter out a large number of vehicle network intrusion information without omitting diverse information content.

[0052] As an optional implementation, the electronic control unit determines the similarity of intrusion events corresponding to information types, and determines the information filtering method based on the similarity of intrusion events, including:

[0053] If the information type is message identifier abnormal, the electronic control unit determines that the similarity of the intrusion event corresponding to the information type is different from the intrusion event, and determines the information filtering method as the first filtering method;

[0054] If the information type is message period abnormality, the electronic control unit determines that the similarity of the intrusion event corresponding to the information type is the same as the intrusion event, and determines the information filtering method to be the second filtering method.

[0055] When intrusion events are different, a first filtering method can be used. This first filtering method can be a forwarding filtering method, which can collect diverse intrusion event content. For example, when the information type is message identifier abnormality, there are many types of message identifiers. Using the forwarding filtering method can collect as much vehicle network intrusion information as possible under various CANID error types. When intrusion events are the same, a second filtering method can be used. This second filtering method can be an aggregation filtering method, which can balance the data volume and prevent the problem of normal vehicle network information not being sent to the cloud during a certain period due to excessive data volume. For example, when the information type is message period abnormality, the message period may be relatively fixed, and there is no need for a large number of vehicle network intrusion information of this type. Therefore, using the aggregation filtering method can balance the data volume and reduce the number of vehicle network intrusion information.

[0056] The ForwardNthFilter method has a configuration parameter, IdsMNthParameter, which reflects the sampling interval of vehicular network intrusion information. If this forwarding filtering method is configured for a type of vehicular network intrusion information (such as CANID errors), then this parameter indicates that the first and N*IdMNthParameter (N is a positive integer) CANID error vehicular network intrusion information will pass through the filter, while the remaining CANID error vehicular network intrusion information will be discarded. The IdsMNthParameter parameter is set according to the importance of the vehicular network intrusion information. If the importance is high, the IdsMNthParameter parameter can be set smaller, so that more vehicular network intrusion information is collected; conversely, if the importance is low, it can be set larger to reduce the number of vehicular network intrusion information.

[0057] The aggregation filtering method has two configuration parameters: `IdsMEventAggregationTimeInterval` and `IdsMContextDataSourceSelector`. If an aggregation filtering method is configured for vehicular network intrusion information of a certain information type (such as CANID error), the `IdsMEventAggregationTimeInterval` parameter represents the aggregation time period, during which all vehicular network intrusion information with CANID errors is aggregated. The `IdsMContextDataSourceSelector` parameter represents the source of the timestamp of the intrusion event and the intrusion proof information (ContextData) carried by the CANID error type vehicular network intrusion information aggregated within the aggregation time period. The `IdsMEventAggregationTimeInterval` parameter is set according to the level of detail required for the intrusion proof information of the detected vehicular network intrusion information; a smaller value indicates a higher value, and vice versa.

[0058] The `IDsMContextDataSourceSelector` has two values: `IDSM_FILTERS_CTX_USE_FIRST` and `IDSM_FILTERS_CTX_USE_LAST`. When `IDSM_FILTERS_CTX_USE_FIRST` is selected, the timestamp and intrusion proof information of the first CANID error type vehicular network intrusion message within the aggregation period are used as the timestamp and intrusion proof information for the aggregated CANID error type vehicular network intrusion messages. When `IDSM_FILTERS_CTX_USE_LAST` is selected, the timestamp and intrusion proof information of the last CANID error type vehicular network intrusion message within the aggregation period are used as the timestamp and intrusion proof information for the aggregated CANID error type vehicular network intrusion messages. The IdsMContextDataSourceSelector parameter is set based on the old and new values ​​of the intrusion information obtained from the vehicle network. To obtain intrusion proof information closer to the current time, the IdsMContextDataSourceSelector parameter can be set to IDSM_FILTERS_CTX_USE_LAST; otherwise, it can be set to IDSM_FILTERS_CTX_USE_FIERST.

[0059] When configuring parameters, the Configurator tool can be used. During configuration, `IdsMFilterChainRef` represents the filter chain for configuring vehicular network intrusion information; `IdsMTimestampSupport` indicates whether timestamps are required for vehicular network intrusion information; `IdsMSignatureSupport` indicates whether signatures are required for the vehicular network intrusion information; `IdsMContextDataSupport` indicates whether intrusion proof information is required for the vehicular network intrusion information. `IdsMContextDataSourceSelector` indicates whether the intrusion proof information and timestamp of the first or last vehicular network intrusion information are used when aggregating vehicular network intrusion information; `IDSM_FILTERS_CTX_USE_FIRST` indicates using the first vehicular network intrusion information, and `IDSM_FILTERS_CTX_USE_LAST` indicates using the last vehicular network intrusion information; `IdsMEventAggregationTimeInterval` represents the time interval for aggregating vehicular network intrusion information; and `IdsMNthParameter` represents the configuration of the sampling points for the forwarding filtering method `ForwardNthFilter`.

[0060] As another optional implementation, the electronic control unit determines the similarity of intrusion events corresponding to information types, and determines the information filtering method based on the similarity of intrusion events, including:

[0061] If the information type is message identifier abnormal and the difference in the number of intrusion events occurring within multiple uniform time periods is less than a preset difference, the electronic control unit determines that the similarity of the intrusion events corresponding to the information type is different from the intrusion events, and determines the information filtering method as the first filtering method.

[0062] If the information type is message identifier abnormal and the difference in the number of intrusion events occurring within multiple uniform time periods is not less than a preset difference, the electronic control unit determines that the similarity of the intrusion events corresponding to the information type is different from the intrusion events, and determines the information filtering method as the first filtering method and the second filtering method, wherein the filtering order of the first filtering method is earlier than that of the second filtering method.

[0063] If the information type is message period abnormality, the electronic control unit determines that the similarity of the intrusion event corresponding to the information type is the same as the intrusion event, and determines the information filtering method to be the second filtering method.

[0064] In this implementation, determining the information filtering method requires not only considering the information type but also assessing whether the number of intrusion events is uniform within a given time period. If the information type is message identifier abnormality and the number of intrusion events is relatively similar within a given time period, a forwarding filtering method can be used. This involves filtering vehicle network intrusion information through sampling points, allowing for the collection of as many different types of vehicle network intrusion information with varying CANID error types as possible. If the information type is message identifier abnormality and the number of intrusion events varies significantly within a given time period, a forwarding filtering method can first be used to ensure the diversity of CANID error type vehicle network intrusion information content. However, to avoid a situation where the number of intrusion events is high in a particular time period, an aggregation filtering method can be used to balance the data volume and reduce the impact on the transmission of normal vehicle network information to the cloud during that time period. If the information type is message period abnormality, the message period may be relatively fixed, and a large number of vehicle network intrusion information of this type is unnecessary. Therefore, an aggregation filtering method can balance the data volume of vehicle network information (which includes normal vehicle network information and vehicle network intrusion information) across different time periods, reducing the number of vehicle network intrusion information.

[0065] Furthermore, if the information type is message identifier abnormal, indicating that there are many types of message identifiers, the first filtering method adopted is the forwarding filtering method. The forwarding filtering method filters the vehicle network intrusion information at the preset sampling point by setting a sampling point interval, and discards the rest of the vehicle network intrusion information.

[0066] If the information type is message period abnormality, and the message periods indicating abnormality are the same, the second filtering method is the aggregation filtering method. The aggregation filtering method filters the vehicle network intrusion information with the first or last message period abnormality within the aggregation time period by setting an aggregation time period, retains the number of vehicle network intrusion information within the aggregation time period, and discards the rest of the vehicle network intrusion information.

[0067] Step 103: The electronic control unit filters multiple vehicle network intrusion information of the same information type based on the information filtering method, and sends at least a portion of the filtered vehicle network intrusion information to the cloud.

[0068] Since the first information filtering method filters out vehicle network intrusion information at multiple sampling point intervals within a certain time period, while the second information filtering method filters out the first or last vehicle network intrusion information within a certain time period, under the same time period, the number of vehicle network intrusion information filtered out by the first information filtering method is greater than the number of vehicle network intrusion information filtered out by the second information filtering method.

[0069] As an optional implementation, the electronic control unit filters multiple vehicle network intrusion information of the same information type based on information filtering, and sends at least a portion of the filtered vehicle network intrusion information to the cloud, including: obtaining vehicle network intrusion information at a preset sampling point from multiple vehicle network intrusion information of the same information type, and sending the vehicle network intrusion information at the preset sampling point to the cloud.

[0070] In this implementation, the information type can be a message identifier anomaly (such as a CANID error). The information filtering method corresponding to the message identifier anomaly is the first filtering method, which is a forwarding filtering method. That is, the preset sampling point for vehicle network intrusion information is determined by the configuration parameter IdsMNthParameter, and the vehicle network intrusion information at the preset sampling point is sent to the cloud. This allows for the collection of as many different types of vehicle network intrusion information under the CANID error type as possible.

[0071] For example, the information types of vehicle network intrusion information are message identifier abnormality, message period abnormality, and vehicle speed abnormality. The event identifier corresponding to the message identifier abnormality type is event_id=23, the event identifier corresponding to the message period abnormality type is event_id=46, and the event identifier corresponding to the vehicle speed abnormality type is event_id=60. The CANID error type of vehicle network intrusion information is configured with a forwarding filtering method, while the other two types of vehicle network intrusion information are not configured with a forwarding filtering method. The configuration parameter IdsMNthParameter=4 for the forwarding filtering method can count event_id=23 from the start of the intrusion detection system (IDS). Since the 1st and N*4th vehicle network intrusion information can be sent to the cloud, if there are 5 vehicle network intrusion information with event_id=23, only the 1st and 4th event_id=23 vehicle network intrusion information can be sent to the cloud. In addition to the event identifier (event_id) representing the information type, the information sent to the cloud may also include intrusion proof information (contextData). If contextData = 0x47, it indicates that the CANID is 0x47, signifying an intrusion proof message with an incorrect CANID. Of course, the information sent to the cloud may also include the timestamp of the intrusion event and the number of intrusion messages to the vehicle network within a preset time period.

[0072] As another optional implementation, the electronic control unit filters multiple vehicle network intrusion messages of the same information type based on an information filtering method, and sends at least a portion of the filtered vehicle network intrusion messages to the cloud, including:

[0073] From multiple vehicle network intrusion messages within a preset time period, select the vehicle network intrusion messages located at the endpoints to obtain filtered vehicle network intrusion messages;

[0074] The filtered intrusion information of the vehicle network is parsed to obtain the timestamp of the intrusion event and the intrusion proof information;

[0075] The timestamp, intrusion proof information, and the number of intrusion messages into the vehicle network within a preset time period are sent to the cloud.

[0076] In this implementation, the information type can be message period anomaly, and the information filtering method corresponding to message period anomaly is the second filtering method, which is an aggregation filtering method. This means that the aggregation time period is determined by the configuration parameter `IdsMEventAggregationTimeInterval`, and the source of the timestamp and intrusion proof information (ContextData) is determined by the configuration parameter `IdsMContextDataSourceSelector`. Since the message period is relatively fixed, there is no need for a large number of vehicular network intrusion messages of this information type. Therefore, using the aggregation filtering method can balance the data volume and reduce the number of vehicular network intrusion messages.

[0077] For example, the information types for vehicular network intrusion information are packet identifier abnormality, packet period abnormality, and vehicle speed abnormality. The event identifier corresponding to the packet identifier abnormality type is event_id=23, the event identifier corresponding to the packet period abnormality type is event_id=46, and the event identifier corresponding to the vehicle speed abnormality type is event_id=60. The vehicular network intrusion information of the packet period abnormality type is configured with aggregation filtering, while the other two types of vehicular network intrusion information are not configured with aggregation filtering. The configuration parameter for aggregation filtering is Aggregation. `Filtertimer=4` means that the parameter `IdsMEventAggregationTimeInterval` is 40ms, and the parameter `IdsMContextDataSourceSelector` is `IDSM_FILTERS_CTX_USE_FIRST`. This indicates that from the start of the Intrusion Detection System (IDS), within each 40ms period, vehicular network intrusion information with `event_id=60` will be aggregated. If there are four vehicular network intrusion messages with `event_id=60` indicating anomalies, the aggregated `event_id=60` vehicular network intrusion message's count will be the sum of the counts of the four vehicular network intrusion messages. The `contextData` and `Timestamp` are selected from the `contextData` and `timestamp` information of the first `event_id=60` vehicular network intrusion message within the first period. Using aggregation filtering in this case can balance the data volume.

[0078] As another optional implementation, when there are a large number of intrusion messages in the vehicle network and the difference in the number of intrusion events occurring in multiple uniform time periods is not less than a preset difference, and the information type is message identifier abnormal, the first filtering method can be combined with the second filtering method. For example, the event identifier corresponding to the message identifier abnormal type is event_id=23, the event identifier corresponding to the message period abnormal type is event_id=46, and the event identifier corresponding to the vehicle speed abnormal type is event_id=60. The vehicle network intrusion message of CANID error type is configured with forwarding filtering method and aggregation filtering method. It can count event_id=23 from the start of the intrusion detection system IDS. First, the forwarding filtering method Forward NthFilter is used. Assuming that the parameter IdsMNthParameter of the forwarding filtering method is 3, the first and n*3 (n is a natural number) vehicle network intrusion messages with event_id=23 will be filtered. Then, the aggregation filtering method AggregationFilter is used to process the Forward Nth filter in each period. The Filter aggregates vehicular network intrusion messages with event_id=23. One parameter of the aggregation filtering method, IdsMEventAggregationTimeInterval, is 40ms. Within this period, two vehicular network intrusion messages with event_id=23 need to be aggregated, resulting in a total count of 2 aggregated messages with event_id=23. Another parameter, IdsMContextDataSourceSelector=IDSM_FILTERS_CTX_USE_LAST, selects the ContxtData and TimeStamp information from the last vehicular network intrusion message with event_id=23. Using both filtering methods simultaneously in this scenario reduces cloud data storage and balances data volume, preventing network paralysis caused by a large number of intrusion messages.

[0079] Of course, if the number of vehicle network intrusion information is small, such as less than the preset amount, the vehicle network intrusion information can be sent directly to the cloud.

[0080] As an optional implementation, at least a portion of the filtered vehicle network intrusion information is sent to the cloud, including:

[0081] If the amount of data to be sent is not less than the preset amount of data, the information to be sent will be sent to the cloud; the information to be sent is at least a portion of the filtered vehicle network intrusion information that has not been sent to the cloud.

[0082] or,

[0083] According to the preset sending cycle, at least a portion of the filtered vehicle network intrusion information obtained within the sending cycle is sent to the cloud.

[0084] In this implementation, there can be two information buffers, SaveBuffer, which have three attributes: Empty, Active, and Lock. SaveBuffers with the Empty attribute can store filtered vehicle network intrusion information and are marked as Active. SaveBuffers with the Active attribute can be used for transmission. SaveBuffers in transmission are marked with the Lock attribute. SaveBuffers with the Lock attribute cannot be used for storage to prevent interference with SaveBuffers in transmission.

[0085] When the amount of data stored in the SaveBuffer security log is not less than IdsMMaxTransmitBytes (the preset data size, which can be the maximum number of bytes that can be stored in the SaveBuffer, usually an integer multiple of the maximum storage required for vehicle network intrusion information), at least a portion of the filtered vehicle network intrusion information that has not yet been sent to the cloud can be sent to the cloud. When the amount of data stored in the security log is not less than IdsMMaxTransmitBytes, the SaveBuffer property is immediately locked, and then the data is promptly transmitted to the cloud. After the transmission is complete, the SaveBuffer property is set to Empty, and the data can continue to be used for storage. Of course, it can also be transmitted to the cloud according to the configured parameter IdsMTransmitTime (the preset transmission period, i.e., the time interval for uploading information to the cloud, which can be set to once every 1000ms).

[0086] The present invention also provides an information processing system applied to an electronic control unit, such as... Figure 2 As shown, the system includes:

[0087] The information type determination module 201 is configured to parse the vehicle network intrusion information by the electronic control unit and obtain the information type of the vehicle network intrusion information.

[0088] The filtering method determination module 202 is configured to determine the similarity of intrusion events corresponding to the information type by the electronic control unit, and determine the information filtering method based on the intrusion event similarity. Here, intrusion event similarity means either the intrusion events are different or the intrusion events are the same. An intrusion event is an event in which the electronic control unit is attacked, generating vehicle network intrusion information when an intrusion event occurs. When the intrusion events are different, a first filtering method is used, which is a filtering method that uses sampling points to filter vehicle network intrusion information; when the intrusion events are the same, a second filtering method is used, which is a filtering method that selects at least one vehicle network intrusion information within a preset time period.

[0089] The information filtering module 203 is configured to allow the electronic control unit to filter multiple vehicle network intrusion information of the same information type based on the information filtering method, and send at least a portion of the filtered vehicle network intrusion information to the cloud.

[0090] As an optional implementation, the filtering method determination module 202 includes:

[0091] The first method determination unit is configured to, if the information type is message identifier abnormal, determine that the similarity of the intrusion event corresponding to the information type is different from the intrusion event, and determine the information filtering method as the first filtering method; if the information type is message period abnormal, determine that the similarity of the intrusion event corresponding to the information type is the same as the intrusion event, and determine the information filtering method as the second filtering method.

[0092] The second method determination unit is configured to determine the information filtering method as follows: if the information type is message identifier abnormal and the difference in the number of intrusion events occurring within multiple evenly spaced time periods is less than a preset difference, the electronic control unit determines that the similarity between the intrusion events corresponding to the information type is different from the intrusion events, and determines the information filtering method as the first filtering method; if the information type is message identifier abnormal and the difference in the number of intrusion events occurring within multiple evenly spaced time periods is not less than a preset difference, the electronic control unit determines that the similarity between the intrusion events corresponding to the information type is different from the intrusion events, and determines the information filtering method as the first filtering method and the second filtering method, wherein the filtering order of the first filtering method is earlier than that of the second filtering method; if the information type is message period abnormal, the electronic control unit determines that the similarity between the intrusion events corresponding to the information type is the same as the intrusion events, and determines the information filtering method as the second filtering method.

[0093] Optionally, if the information type is message identifier abnormal, indicating that there are many types of message identifiers, the first filtering method is the forwarding filtering method. The forwarding filtering method filters the vehicle network intrusion information at the preset sampling point by setting a sampling point interval, and discards the rest of the vehicle network intrusion information.

[0094] If the information type is message period abnormality, and the message periods indicating abnormality are the same, the second filtering method is the aggregation filtering method. The aggregation filtering method filters the vehicle network intrusion information with the first or last message period abnormality within the aggregation time period by setting an aggregation time period, retains the number of vehicle network intrusion information within the aggregation time period, and discards the rest of the vehicle network intrusion information.

[0095] Information filtering module 203 includes:

[0096] The first filtering unit is configured to obtain vehicle network intrusion information at a preset sampling point from multiple vehicle network intrusion information of the same information type, and send the vehicle network intrusion information at the preset sampling point to the cloud.

[0097] The second filtering unit is configured to select vehicle network intrusion information located at an endpoint from multiple vehicle network intrusion information within a preset time period to obtain filtered vehicle network intrusion information; parse the filtered vehicle network intrusion information to obtain the timestamp of the intrusion event and intrusion proof information; and send the timestamp, intrusion proof information and the number of vehicle network intrusion information within the preset time period to the cloud.

[0098] The information filtering module 203 also includes:

[0099] The sending unit is configured to send the information to be sent to the cloud when the amount of data to be sent is not less than a preset amount of data; the information to be sent is at least a portion of the filtered vehicle network intrusion information that has not been sent to the cloud.

[0100] or,

[0101] According to the preset sending cycle, at least a portion of the filtered vehicle network intrusion information obtained within the sending cycle is sent to the cloud.

[0102] This invention provides a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements the above-described information processing method.

[0103] This invention provides an electronic device, such as... Figure 3 As shown, the electronic device 30 includes at least one processor 301, at least one memory 302 connected to the processor 301, and a bus 303; wherein the processor 301 and the memory 302 communicate with each other through the bus 303; the processor 301 is used to call program instructions in the memory 302 to execute the above-described information processing method. The electronic device in this article may be a server, PC, PAD, mobile phone, etc.

[0104] This application also provides a computer program product that, when executed on a data processing device, is adapted to perform a program that initializes the steps included in the above-described information processing method.

[0105] This application is described with reference to flowchart illustrations and / or block diagrams of methods, systems, and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0106] In a typical configuration, the device includes one or more processors (CPUs), memory, and a bus. The device may also include input / output interfaces, network interfaces, etc.

[0107] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM, and memory includes at least one memory chip. Memory is an example of computer-readable media.

[0108] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0109] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0110] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0111] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0112] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. An information processing method, characterized in that, The information processing method is applied to an electronic control unit, and the method includes: The electronic control unit parses the vehicle network intrusion information to obtain the information type of the vehicle network intrusion information; The electronic control unit determines the similarity of intrusion events corresponding to the information type, and determines an information filtering method based on the intrusion event similarity; the intrusion event similarity is either different intrusion events or the same intrusion events, and the intrusion event is an event in which the electronic control unit is attacked. When the intrusion event occurs, the vehicle network intrusion information is generated; when the intrusion events are different, a first filtering method is used, which is a filtering method that uses sampling points to filter the vehicle network intrusion information; when the intrusion events are the same, a second filtering method is used, which is a filtering method that selects at least one piece of vehicle network intrusion information within a preset time period. The electronic control unit filters multiple vehicle network intrusion messages of the same information type based on the information filtering method, and sends at least a portion of the filtered vehicle network intrusion messages to the cloud. The electronic control unit determines the similarity of the intrusion event corresponding to the information type, and determines the information filtering method based on the similarity of the intrusion event, including: If the information type is message identifier abnormal, the electronic control unit determines that the similarity of the intrusion event corresponding to the information type is different from the intrusion event, and determines that the information filtering method is the first filtering method; If the information type is message period abnormal, the electronic control unit determines that the similarity of the intrusion event corresponding to the information type is the same as the intrusion event, and determines that the information filtering method is the second filtering method; Alternatively, the electronic control unit determines the similarity of an intrusion event corresponding to the information type, and determines an information filtering method based on the similarity of the intrusion events, including: If the information type is message identifier abnormal and the difference in the number of intrusion events occurring within multiple uniform time periods is less than a preset difference, then the electronic control unit determines that the similarity of the intrusion event corresponding to the information type is different from the intrusion event, and determines that the information filtering method is the first filtering method. If the information type is message identifier abnormal and the difference in the number of intrusion events occurring within multiple uniform time periods is not less than a preset difference, then the electronic control unit determines that the similarity of the intrusion event corresponding to the information type is different from the intrusion event, and determines that the information filtering method is the first filtering method and the second filtering method, wherein the filtering order of the first filtering method is earlier than that of the second filtering method. If the information type is message period abnormal, the electronic control unit determines that the similarity of the intrusion event corresponding to the information type is the same as the intrusion event, and determines that the information filtering method is the second filtering method.

2. The information processing method according to claim 1, characterized in that, If the information type is message identifier abnormal, indicating that there are many types of message identifiers, the first filtering method used is the forwarding filtering method. The forwarding filtering method filters the vehicle network intrusion information at the preset sampling point by setting a sampling point interval, and discards the rest of the vehicle network intrusion information. If the information type is message period abnormality, and the message periods indicating abnormality are the same, the second filtering method used is the aggregation filtering method. The aggregation filtering method filters the vehicle network intrusion information with the first or last message period abnormality within the aggregation time period by setting an aggregation time period, retains the number of vehicle network intrusion information within the aggregation time period, and discards the remaining vehicle network intrusion information.

3. The information processing method according to claim 1, characterized in that, The electronic control unit filters multiple vehicle network intrusion messages of the same information type based on the information filtering method, and sends at least a portion of the filtered vehicle network intrusion messages to the cloud, including: From multiple vehicle network intrusion information of the same information type, obtain vehicle network intrusion information at a preset sampling point, and send the vehicle network intrusion information at the preset sampling point to the cloud.

4. The information processing method according to claim 1, characterized in that, The electronic control unit filters multiple vehicle network intrusion messages of the same information type based on the information filtering method, and sends at least a portion of the filtered vehicle network intrusion messages to the cloud, including: From multiple vehicle network intrusion messages within a preset time period, select the vehicle network intrusion message located at the endpoint to obtain the filtered vehicle network intrusion message; The filtered vehicle network intrusion information is parsed to obtain the timestamp of the intrusion event and intrusion proof information; The timestamp, the intrusion proof information, and the number of vehicle network intrusion messages within a preset time period are sent to the cloud.

5. The information processing method according to claim 1, characterized in that, Sending at least a portion of the filtered vehicle network intrusion information to the cloud includes: If the amount of data to be sent is not less than a preset amount of data, the information to be sent is sent to the cloud; the information to be sent is at least a portion of the filtered vehicle network intrusion information that has not been sent to the cloud. or, According to a preset sending period, at least a portion of the filtered vehicle network intrusion information obtained within the sending period is sent to the cloud.

6. An information processing system, characterized in that, The information processing system is applied to the electronic control unit, and the system includes: The information type determination module is configured to parse the vehicle network intrusion information by the electronic control unit to obtain the information type of the vehicle network intrusion information; The filtering method determination module is configured to: determine the similarity of intrusion events corresponding to the information type for the electronic control unit; and determine the information filtering method based on the intrusion event similarity; the intrusion event similarity is either different or the same, and the intrusion event is an event in which the electronic control unit is attacked; in the event of the intrusion event, the vehicle network intrusion information is generated; in the case of different intrusion events, a first filtering method is adopted, which is a filtering method that uses sampling points to filter the vehicle network intrusion information; in the case of the same intrusion events, a second filtering method is adopted, which is a filtering method that selects at least one piece of the vehicle network intrusion information within a preset time period. The information filtering module is configured to allow the electronic control unit to filter multiple vehicle network intrusion messages of the same information type based on the information filtering method, and to send at least a portion of the filtered vehicle network intrusion messages to the cloud. The filtering method determination module includes: The first method determination unit is configured to, if the information type is message identifier abnormal, determine that the similarity of the intrusion event corresponding to the information type is different from the intrusion event, and determine the information filtering method as the first filtering method; if the information type is message period abnormal, determine that the similarity of the intrusion event corresponding to the information type is the same as the intrusion event, and determine the information filtering method as the second filtering method. The second method determination unit is configured to determine the information filtering method as follows: if the information type is message identifier abnormal and the difference in the number of intrusion events occurring within multiple evenly spaced time periods is less than a preset difference, the electronic control unit determines that the similarity between the intrusion events corresponding to the information type is different from the intrusion events, and determines the information filtering method as the first filtering method; if the information type is message identifier abnormal and the difference in the number of intrusion events occurring within multiple evenly spaced time periods is not less than a preset difference, the electronic control unit determines that the similarity between the intrusion events corresponding to the information type is different from the intrusion events, and determines the information filtering method as the first filtering method and the second filtering method, wherein the filtering order of the first filtering method is earlier than that of the second filtering method; if the information type is message period abnormal, the electronic control unit determines that the similarity between the intrusion events corresponding to the information type is the same as the intrusion events, and determines the information filtering method as the second filtering method.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program that, when executed by a processor, implements the information processing method according to any one of claims 1-5.

8. An electronic device, characterized in that, include: At least one processor, and at least one memory and bus connected to the processor; The processor and the memory communicate with each other via the bus; The processor is used to invoke program instructions in the memory to execute the information processing method according to any one of claims 1-5.

Images