Intrusion detection method, device, electronic device and storage medium based on UDS protocol

Abstract

The present disclosure provides an intrusion detection method, device, electronic device and storage medium based on the UDS protocol, which relates to the field of vehicle networking technology. The method includes: obtaining a message to be detected; the message to be detected is a unified diagnostic service (UDS) message obtained based on the parsing of the controller area network (CAN) message; detecting the message to be detected according to a preset detection strategy to obtain a detection result; the preset detection strategy includes: a first preset detection strategy, a second preset detection strategy, and a third preset detection strategy; the first preset detection strategy is used for abnormal session control detection, the second preset detection strategy is used for abnormal security access detection, and the third preset detection strategy is used for abnormal context detection of UDS messages. The use of this method can timely detect attackers who achieve their attack goals by injecting UDS messages, thereby ensuring the safety of vehicles and drivers.

Description

Technical Field

[0001] The present disclosure relates to the field of vehicle networking technology, and in particular to an intrusion detection method, device, electronic device, and storage medium based on the UDS protocol. Background Art

[0002] The Unified Diagnostic Services (UDS) protocol is a universal automotive diagnostic protocol defined by ISO 15765 and ISO 14229. It primarily provides unified diagnostic capabilities for onboard electronic control units (ECUs). For example, secure access to ECUs, program flashing, and reading diagnostic trouble codes are all handled by the UDS protocol. As a protocol that easily connects to the outside world, UDS raises increasingly prominent security concerns. Using UDS to modify high-security calibration information within the vehicle or interfere with the operation of ECUs can significantly impact vehicle safety.

[0003] In the existing technology, anomaly detection and analysis is mainly performed based on the protocol format of CAN (Controller Area Network) messages. However, the detection scope of the existing technology is limited to the CAN message format specification and cannot perform security detection based on the protocol characteristics of the UDS protocol itself. Summary of the Invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides an intrusion detection method, device, electronic device and storage medium based on the UDS protocol, which solves the problem that the detection scope of the existing technology is limited to the CAN message format specification and cannot perform security detection on the protocol characteristics of the UDS protocol itself.

[0005] In order to achieve the above objectives, the embodiments of the present disclosure provide the following technical solutions:

[0006] In a first aspect, an embodiment of the present disclosure provides an intrusion detection method based on the UDS protocol, the method comprising:

[0007] Obtaining a message to be detected; the message to be detected is a unified diagnostic service UDS message obtained based on controller area network CAN message parsing;

[0008] The message to be detected is detected according to a preset detection strategy to obtain a detection result; the preset detection strategy includes: a first preset detection strategy, a second preset detection strategy, and a third preset detection strategy; the first preset detection strategy is used for abnormal session control detection, the second preset detection strategy is used for abnormal security access detection, and the third preset detection strategy is used for abnormal context detection of UDS messages.

[0009] As an optional implementation of the embodiment of the present disclosure, obtaining the message to be detected includes:

[0010] Receive CAN messages broadcast by the target electronic control unit;

[0011] Parsing the CAN message broadcast by the target electronic control unit to obtain a corresponding UDS message; the UDS message carries a diagnostic request message; the diagnostic request message includes: a first diagnostic request message and a second diagnostic request message; the first diagnostic request message includes: a diagnostic service ID, an operation type of the diagnostic service, and diagnostic parameters; the second diagnostic request message includes: a diagnostic service ID and diagnostic parameters;

[0012] The message to be detected is obtained according to the type of the diagnosis request message carried by the UDS message.

[0013] As an optional implementation of the embodiment of the present disclosure, when the preset detection strategy is the first preset detection strategy, detecting the message to be detected according to the preset detection strategy and obtaining the detection result includes:

[0014] When the diagnostic request message carried by the UDS message is a first diagnostic request message, obtaining a target diagnostic service ID and a target diagnostic service operation type according to the message to be detected;

[0015] When it is detected that the target diagnostic service ID is the first diagnostic service ID, detecting whether the target diagnostic service operation type belongs to any one of the first diagnostic service operation type, the second diagnostic service operation type, and the third diagnostic service operation type;

[0016] If the target diagnostic service operation type belongs to any one of the first diagnostic service operation type, the second diagnostic service operation type, and the third diagnostic service operation type, determining that the session control of the target electronic control unit is normal;

[0017] Otherwise, the number of abnormal behaviors is recorded by a counter. When the number of abnormal behaviors is greater than a preset number of behaviors, it is determined that the target electronic control unit is attacked.

[0018] As an optional implementation of the embodiment of the present disclosure, when the preset detection strategy is the second preset detection strategy, detecting the message to be detected according to the preset detection strategy and obtaining the detection result includes:

[0019] When the diagnostic request message carried by the UDS message is a first diagnostic request message, obtaining a target diagnostic service ID and a target diagnostic service operation type according to the message to be detected;

[0020] When the target diagnostic service ID carried by the message to be detected is the second diagnostic service ID and the target diagnostic service operation type is the first diagnostic service operation type, detecting whether the response of the target electronic control unit is a negative response;

[0021] If it is detected that the number of negative responses returned by the target electronic control unit to the test equipment exceeds a threshold number within a preset time period, it is determined that the security access of the target electronic control unit is abnormal.

[0022] As an optional implementation of the embodiment of the present disclosure, the detecting whether the response of the target electronic control unit is a negative response includes:

[0023] Receive a message to be tested sent by a test device; the message to be tested carries a target diagnostic service ID, a target diagnostic service operation type, and a first request seed;

[0024] Encrypting the first request seed according to a random number generation algorithm to generate a second request seed;

[0025] sending the second request seed to the test device, so that the test device encrypts the second request seed according to a random number generation algorithm to generate a first key, and sends the target diagnostic service ID, the target diagnostic service operation type, and the first key to a target electronic control unit;

[0026] receiving the target diagnostic service ID, the target diagnostic service operation type, and the first key, and verifying the first key according to the local key;

[0027] If the local key is consistent with the first key, sending a positive response to the test device;

[0028] If the local key is inconsistent with the first key, a negative response is sent to the test device.

[0029] As an optional implementation of the embodiment of the present disclosure, when the preset detection strategy is the third preset detection strategy, detecting the message to be detected according to the preset detection strategy and obtaining the detection result includes:

[0030] According to the message to be detected, a CAN message corresponding to the message to be detected is obtained; the CAN message carries a CAN message ID and a first signal value; the first signal value represents a configurable signal value in the CAN message;

[0031] Determine whether a UDS message injection operation is performed according to the CAN message ID and the first signal value.

[0032] As an optional implementation of the embodiment of the present disclosure, before obtaining the message to be detected, the method further includes:

[0033] Set the parameters of the configuration file; the parameters of the configuration file include: preset behavior times, threshold times, CAN message ID, first signal value, and UDS message ID range.

[0034] In a second aspect, an embodiment of the present disclosure provides an intrusion detection device based on the UDS protocol, comprising:

[0035] An acquisition module is used to acquire a message to be detected; the message to be detected is a unified diagnostic service UDS message obtained based on controller area network CAN message analysis;

[0036] An analysis module is used to detect the message to be detected according to a preset detection strategy and obtain a detection result; the preset detection strategy includes: a first preset detection strategy, a second preset detection strategy, and a third preset detection strategy; the first preset detection strategy is used for abnormal session control detection, the second preset detection strategy is used for abnormal security access detection, and the third preset detection strategy is used for UDS message context detection.

[0037] As an optional implementation of the embodiment of the present disclosure, the acquisition module is specifically configured to:

[0038] Receive CAN messages broadcast by the target electronic control unit;

[0039] Parsing the CAN message broadcast by the target electronic control unit to obtain a corresponding UDS message; the UDS message carries a diagnostic request message; the diagnostic request message includes: a first diagnostic request message and a second diagnostic request message; the first diagnostic request message includes: a diagnostic service ID, an operation type of the diagnostic service, and diagnostic parameters; the second diagnostic request message includes: a diagnostic service ID and diagnostic parameters;

[0040] The message to be detected is obtained according to the type of the diagnosis request message carried by the UDS message.

[0041] As an optional implementation of the embodiment of the present disclosure, when the preset detection strategy is the first preset detection strategy, the analysis module is specifically configured to:

[0042] When the diagnostic request message carried by the UDS message is a first diagnostic request message, obtaining a target diagnostic service ID and a target diagnostic service operation type according to the message to be detected;

[0043] When it is detected that the target diagnostic service ID is the first diagnostic service ID, detecting whether the target diagnostic service operation type belongs to any one of the first diagnostic service operation type, the second diagnostic service operation type, and the third diagnostic service operation type;

[0044] If the target diagnostic service operation type belongs to any one of the first diagnostic service operation type, the second diagnostic service operation type, and the third diagnostic service operation type, determining that the session control of the target electronic control unit is normal;

[0045] Otherwise, the number of abnormal behaviors is recorded by a counter. When the number of abnormal behaviors is greater than a preset number of behaviors, it is determined that the target electronic control unit is attacked.

[0046] As an optional implementation of the embodiment of the present disclosure, when the preset detection strategy is the second preset detection strategy, the analysis module includes:

[0047] an acquiring unit, configured to acquire a target diagnostic service ID and a target diagnostic service operation type according to the message to be detected when the diagnostic request message carried by the UDS message is a first diagnostic request message;

[0048] a detection unit, configured to detect whether a response of a target electronic control unit is a negative response when the target diagnostic service ID carried by the message to be detected is the second diagnostic service ID and the target diagnostic service operation type is the first diagnostic service operation type;

[0049] The determining unit is configured to determine that the security access of the target electronic control unit is abnormal if it is detected that the number of negative responses returned by the target electronic control unit to the test equipment exceeds a threshold number within a preset time period.

[0050] As an optional implementation of the embodiment of the present disclosure, the detection unit is specifically configured to:

[0051] Receive a message to be tested sent by a test device; the message to be tested carries a target diagnostic service ID, a target diagnostic service operation type, and a first request seed;

[0052] Encrypting the first request seed according to a random number generation algorithm to generate a second request seed;

[0053] sending the second request seed to the test device, so that the test device encrypts the second request seed according to a random number generation algorithm to generate a first key, and sends the target diagnostic service ID, the target diagnostic service operation type, and the first key to a target electronic control unit;

[0054] receiving the target diagnostic service ID, the target diagnostic service operation type, and the first key, and verifying the first key according to the local key;

[0055] If the local key is consistent with the first key, sending a positive response to the test device;

[0056] If the local key is inconsistent with the first key, a negative response is sent to the test device.

[0057] As an optional implementation of the embodiment of the present disclosure, when the preset detection strategy is the third preset detection strategy, the analysis module is configured to:

[0058] According to the message to be detected, a CAN message corresponding to the message to be detected is obtained; the CAN message carries a CAN message ID and a first signal value; the first signal value represents a configurable signal value in the CAN message;

[0059] Determine whether a UDS message injection operation is performed according to the CAN message ID and the first signal value.

[0060] As an optional implementation of the embodiment of the present disclosure, the device further includes:

[0061] The parameter setting module is used to set the parameters of the configuration file; the parameters of the configuration file include: preset behavior times, threshold times, CAN message ID, first signal value, and UDS message ID range.

[0062] In a third aspect, an embodiment of the present disclosure provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the intrusion detection method based on the UDS protocol described in the first aspect or any embodiment of the first aspect.

[0063] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the intrusion detection method based on the UDS protocol described in the first aspect or any embodiment of the first aspect is implemented.

[0064] The intrusion detection method based on the UDS protocol provided by the present invention first obtains the message to be detected, and then detects the message to be detected according to a preset detection strategy to obtain a detection result. Since the message to be detected is a UDS message obtained based on CAN message parsing, and the preset detection strategy includes a strategy for detecting abnormal session control, a strategy for detecting abnormal security access, and a strategy for detecting context anomalies of the UDS message, it is possible to detect the UDS message according to the protocol characteristics of the UDS message and three different usage scenarios, thereby expanding the detection range and making up for the defect that the existing technology cannot perform anomaly detection based on the UDS protocol characteristics, so that it can timely detect attackers who achieve their attack purposes by injecting UDS messages, thereby ensuring the safety of vehicles and drivers. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0066] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0067] Figure 1 1 is a schematic diagram of the format of the CAN protocol in one embodiment;

[0068] Figure 2 FIG. 1 is a flow chart of an intrusion detection method based on the UDS protocol in one embodiment;

[0069] Figure 3a FIG1 is a schematic diagram of a format of a diagnosis request message in one embodiment;

[0070] Figure 3b FIG2 is a second schematic diagram of the format of a diagnosis request message in one embodiment;

[0071] Figure 4 FIG. 1 is a schematic diagram of the structure of an intrusion detection device based on the UDS protocol in one embodiment;

[0072] Figure 5 This is a schematic structural diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0073] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features therein can be combined with each other in the absence of conflict.

[0074] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0075] Relational terms such as “first” and “second” in the description and claims of this disclosure are merely used to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any actual relationship or order between these entities or operations.

[0076] In the embodiments of the present disclosure, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present disclosure should not be interpreted as being more preferred or advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner. In addition, in the description of the embodiments of the present disclosure, unless otherwise specified, the meaning of "multiple" refers to two or more.

[0077] CAN (Controller Area Network) is a serial communication bus based on message broadcast mode. It is used to achieve reliable communication between ECUs (Electronic Control Units) in automobiles. Figure 1 As shown, the main focus is on the Identifier, DLC, and Data Field. Among them, the Identifier is used to identify different CAN messages and can be expressed as a CAN ID. The DLC is used to identify the length of the data field. The DataField represents the data field and carries at least one signal. It should be noted that the specific protocol format of the UDS message is expressed in the data field of the CAN message (that is, Figure 1 The UDS generally communicates between the diagnostic device and the ECU in a question-and-answer format. Therefore, the UDS is generally divided into a diagnostic request message and a diagnostic response message.

[0078] To overcome the defect that the existing technology can only detect anomalies based on CAN message specifications but not on UDS protocol characteristics, the present invention detects UDS messages based on the protocol characteristics of UDS messages and three different usage scenarios, thereby expanding the detection scope and being able to promptly detect attackers who achieve their attack goals by injecting UDS messages, thereby ensuring the safety of vehicles and drivers.

[0079] In one embodiment, Figure 2As shown, an intrusion detection method based on the UDS protocol is provided, comprising the following steps:

[0080] S21. Obtain a message to be detected.

[0081] The message to be detected is a unified diagnostic service (UDS) message obtained based on the analysis of the controller area network (CAN) message.

[0082] In some embodiments, the implementation of step S21 (obtaining the message to be detected) may include:

[0083] Receive CAN messages broadcast by the target electronic control unit.

[0084] The CAN message broadcast by the target electronic control unit is parsed to obtain the corresponding UDS message.

[0085] Among them, the UDS message carries a diagnostic request message; the diagnostic request message includes: a first diagnostic request message and a second diagnostic request message; the first diagnostic request message includes: a diagnostic service ID, an operation type of the diagnostic service, and diagnostic parameters; the second diagnostic request message includes: a diagnostic service ID, and diagnostic parameters.

[0086] The message to be detected is obtained according to the type of the diagnosis request message carried by the UDS message.

[0087] Specifically, the CAN message broadcast by the ECU is parsed to obtain the corresponding UDS message. The UDS message can be understood as the message to be detected. The UDS message carries a diagnostic request message. The UDS request message can be divided into two categories: one is with sub-function, refer to Figure 3a As shown, 311 represents the diagnostic service ID. The length of the Service ID is fixed at 1 byte. The diagnostic service ID is used to indicate the function of the diagnostic command. For example, when the diagnostic ID is 10, it indicates that the diagnostic command executes the function of switching sessions; when the diagnostic ID is 27, it indicates that the diagnostic command executes the function of switching to a safe mode. 312 represents the operation type of the diagnostic service. The operation type of the diagnostic service includes but is not limited to: starting the diagnostic service, stopping the diagnostic service, querying the diagnostic service, etc. 313 represents the diagnostic parameters. The diagnostic parameters are used to limit the conditions for the execution of the diagnostic service. It is determined according to the different contents of each diagnostic service. There is no uniform specification for the length and format, for example, the time when a diagnostic service is executed. There is also a type of diagnostic request without a sub-function, refer to Figure 3bAs shown in the figure, 321 represents the diagnostic service ID. The length of the service ID is fixed at 1 byte and is used to indicate the function executed by the diagnostic command. 322 represents the diagnostic parameters, which are used to define the conditions for executing the diagnostic service. The parameters vary depending on the diagnostic service and have no standardized length or format. A byte is a unit of binary data. A byte is an 8-bit data unit.

[0088] S22: Detect the message to be detected according to a preset detection strategy to obtain a detection result.

[0089] Among them, the preset detection strategies include: a first preset detection strategy, a second preset detection strategy, and a third preset detection strategy; the first preset detection strategy is used for abnormal session control detection, the second preset detection strategy is used for abnormal security access detection, and the third preset detection strategy is used for abnormal context detection of UDS messages.

[0090] The intrusion detection method based on the UDS protocol provided by the present invention first obtains the message to be detected, and then detects the message to be detected according to a preset detection strategy to obtain a detection result. Since the message to be detected is a UDS message obtained based on CAN message parsing, and the preset detection strategy includes a strategy for detecting abnormal session control, a strategy for detecting abnormal security access, and a strategy for detecting context anomalies of the UDS message, it is possible to detect the UDS message according to the protocol characteristics of the UDS message and three different usage scenarios, thereby expanding the detection range and making up for the defect that the existing technology cannot perform anomaly detection based on the UDS protocol characteristics, so that it can timely detect attackers who achieve their attack purposes by injecting UDS messages, thereby ensuring the safety of vehicles and drivers.

[0091] In some embodiments, when the preset detection strategy is the first preset detection strategy, detecting the message to be detected according to the preset detection strategy and obtaining the detection result can be achieved by the following steps ad:

[0092] a. When the diagnostic request message carried by the UDS message is the first diagnostic request message, obtain the target diagnostic service ID and the target diagnostic service operation type according to the message to be detected.

[0093] Specifically, when the message to be detected is a first diagnosis request message, a target diagnosis service ID and a target diagnosis service operation type are obtained.

[0094] b. When it is detected that the target diagnostic service ID is the first diagnostic service ID, detect whether the target diagnostic service operation type belongs to any one of the first diagnostic service operation type, the second diagnostic service operation type, and the third diagnostic service operation type.

[0095] In this embodiment, the first diagnostic service ID is 0x10, and the diagnostic service name corresponding to 0x10 is diagnostic session control.

[0096] Specifically, according to ISO (International Organization for Standardization) specifications, ECU supports three session control modes: Default Session, Program Session, and Extended Session. Each session mode supports different functions. For example, in the default session, ECU supports some simple UDS functions, such as ECU reset and clearing diagnostic information; in comparison, the UDS functions supported by the programming session and extended session are richer, and they also support some high-privilege operations such as ECU data flashing. The ECU automatically enters the default session after power-on. ISO allows car manufacturers to define other sessions during the ECU production process to implement ECU functional testing, such as using the UDS protocol to control the opening and closing of windows.

[0097] c. If the target diagnostic service operation type belongs to any one of the first diagnostic service operation type, the second diagnostic service operation type, and the third diagnostic service operation type, it is determined that the session control of the target electronic control unit is normal.

[0098] For example, refer to Figure 3a As shown, the Sub-Function field identifies three different sessions. The session field corresponding to the first diagnostic service operation type is 0x01, the session field corresponding to the second diagnostic service operation type is 0x02, and the session field corresponding to the third diagnostic service operation type is 0x03. In this embodiment, when the Service ID is detected as 0x10, the Sub-Function value is checked to see if it belongs to any of 0x01, 0x02, and 0x03. If so, it indicates that the session control of the electronic control unit is normal.

[0099] d. Otherwise, the number of abnormal behaviors is recorded by a counter. When the number of abnormal behaviors is greater than a preset number of behaviors, it is determined that the target electronic control unit is attacked.

[0100] Specifically, if the session switching instructions are frequently sent, and the session to be switched in the session switching instructions is not one of the three sessions mentioned above, it is possible that the attacker is attempting to find the factory-customized session in the target electronic control unit to achieve the purpose of the attack.

[0101] For example, when the Service ID is detected as 0x10 and the Sub-Function value is not any of 0x01, 0x02, or 0x03, a counter is used to record the number of abnormal behaviors. When the number of abnormal behaviors exceeds a preset number of behaviors, the electronic control unit is determined to be under attack. It should be noted that the preset number of behaviors can be 3 or 4, or other reasonable values, and is not specifically limited here.

[0102] In some embodiments, when the preset detection strategy is the second preset detection strategy, detecting the message to be detected according to the preset detection strategy and obtaining the detection result can be achieved through the following steps AC:

[0103] A. When the diagnostic request message carried by the UDS message is the first diagnostic request message, obtain a target diagnostic service ID and a target diagnostic service operation type according to the message to be detected.

[0104] Specifically, when the message to be detected is a first diagnosis request message, a target diagnosis service ID and a target diagnosis service operation type are obtained.

[0105] B. When the target diagnostic service ID carried by the message to be detected is the second diagnostic service ID and the target diagnostic service operation type is the first diagnostic service operation type, detecting whether the response of the target electronic control unit is a negative response.

[0106] In this embodiment, the second diagnostic service ID is 0x27, and the diagnostic service name corresponding to 0x27 is security access.

[0107] In some embodiments, when the target diagnostic service ID carried by the message to be detected is the second diagnostic service ID and the target diagnostic service operation type is the first diagnostic service operation type, detecting whether the response of the target electronic control unit is a negative response can be achieved by:

[0108] B1. Receive the message to be tested sent by the test equipment.

[0109] The message to be detected carries the target diagnostic service ID, the target diagnostic service operation type, and the first request seed.

[0110] B2. Encrypt the first request seed according to a random number generation algorithm to generate a second request seed.

[0111] B3. Send the second request seed to the test device, so that the test device encrypts the second request seed according to a random number generation algorithm to generate a first key, and sends the target diagnostic service ID, the target diagnostic service operation type, and the first key to the target electronic control unit.

[0112] B4. Receive the target diagnostic service ID, the target diagnostic service operation type, and the first key, and verify the first key according to the local key.

[0113] B5. If the local key is consistent with the first key, send a positive response to the test device.

[0114] B6. If the local key is inconsistent with the first key, send a negative response to the test device.

[0115] For example, according to ISO specifications, the secure access service (Service ID 0x27) is generally used in the transmission of important information such as data upload and download. The test device acts as the client and the target electronic control unit acts as the server. The secure access process between the two is as follows: First, the test device sends a message to be tested that carries the target diagnostic service ID, the target diagnostic service operation type, and a first request seed. For example, the target diagnostic service ID is 0x27 and the target diagnostic service operation type is 0x01. The target electronic control unit encrypts the first request seed according to a random number generation algorithm to generate a second request seed. The target electronic control unit then sends the second request seed to the test device, which then encrypts the second request seed according to the random number generation algorithm to generate a first key. The target electronic control unit then sends the target diagnostic service ID, the target diagnostic service operation type, and the first key to the target electronic control unit. The target electronic control unit compares the local key with the first key to obtain a verification result. If the local key is the same as the first key, the target electronic control unit sends a positive response to the test device; if the local key is different from the first key, the target electronic control unit sends a negative response to the test device.

[0116] C. If it is detected that the number of negative responses returned by the target electronic control unit to the test equipment exceeds a threshold number within a preset time period, it is determined that the security access of the target electronic control unit is abnormal.

[0117] For this scenario, if the server, that is, the target electronic control unit, does not impose restrictions on the verification of the first key, such as a timeout mechanism or a single-use limit, then the attacker may attempt to crack the first key. That is, the attacker uses different algorithms based on the second request seed sent by the server to the client to generate various first keys, and sends them to the server, attempting to pass the security verification of the server. When the verification passes, the attacker can obtain the security algorithm of the currently calculated first key, thereby achieving the purpose of the attack.

[0118] Therefore, when the test message is detected as 0x27 0x02, the server's response is checked to see if it is a negative response. If, over a period of time, the client frequently sends 0x27 0x02 requests, and the server returns negative responses to the client more than the threshold, then a security access anomaly is determined for the target ECU. This indicates that an attacker may be attempting to crack the target ECU's security algorithm through injection.

[0119] In some embodiments, when the preset detection strategy is the third preset detection strategy, detecting the message to be detected according to the preset detection strategy and obtaining the detection result can be achieved in the following manner:

[0120] According to the message to be detected, a CAN message corresponding to the message to be detected is obtained.

[0121] The CAN message carries a CAN message ID and a first signal value; the first signal value represents a configurable signal value in the CAN message;

[0122] Determine whether a UDS message injection operation is performed according to the CAN message ID and the first signal value.

[0123] The UDS protocol is designed with high diagnostic message permissions, allowing for operations such as restarting the ECU and flashing functions. Therefore, UDS messages typically appear when the vehicle is stationary, such as in repair shops and 4S stores. Sending UDS messages while the vehicle is in motion is dangerous. For example, if an ECU is reset while the vehicle is driving at high speed, restarting it could pose a safety risk to the driver.

[0124] For example, the user can configure the prerequisite for the UDS message to appear. For example, the UDS message can only appear when the user specifies the vehicle speed to be 0. Speed ​​is a signal value carried in the CAN message, so the CAN message ID where the speed signal is located and the vehicle speed need to be configured.

[0125] In this embodiment, the CAN message of the CAN ID where the speed is located is monitored, and the speed signal is extracted from the data field for recording. When a UDS message is detected, whether the UDS message injection operation is performed is determined based on whether the speed is 0.

[0126] In some embodiments, before obtaining the message to be detected, parameters of the configuration file may also be set.

[0127] The parameters of the configuration file include: preset behavior times, threshold times, CAN message ID, first signal value, and UDS message ID range.

[0128] Specifically, the configuration file mainly includes configurations for three detection scenarios, including the preset number of behaviors for session control anomaly detection, the threshold number of abnormal security access detection, and the extraction rules for context signals in UDS message context detection (including CAN ID and signal value). In addition, the ID range of UDS messages can also be included. Since the carrier of UDS messages is CAN messages, the CAN ID range of UDS messages needs to be specified in the configuration file so that the detection engine can identify whether the message to be detected is a UDS message.

[0129] The intrusion detection method based on the UDS protocol provided by the present invention first obtains the message to be detected, and then detects the message to be detected according to a preset detection strategy to obtain a detection result. Since the message to be detected is a UDS message obtained based on CAN message parsing, and the preset detection strategy includes a strategy for detecting abnormal session control, a strategy for detecting abnormal security access, and a strategy for detecting context anomalies of the UDS message, it is possible to detect the UDS message according to the protocol characteristics of the UDS message and three different usage scenarios, thereby expanding the detection range and making up for the defect that the existing technology cannot perform anomaly detection based on the UDS protocol characteristics, so that it can timely detect attackers who achieve their attack purposes by injecting UDS messages, thereby ensuring the safety of vehicles and drivers.

[0130] In one embodiment, Figure 4 As shown, an intrusion detection device 400 based on the UDS protocol is provided, including:

[0131] The acquisition module 410 is used to acquire a message to be detected; the message to be detected is a unified diagnostic service UDS message obtained based on the controller area network CAN message analysis;

[0132] The analysis module 420 is used to detect the message to be detected according to a preset detection strategy and obtain a detection result; the preset detection strategy includes: a first preset detection strategy, a second preset detection strategy, and a third preset detection strategy; the first preset detection strategy is used for abnormal session control detection, the second preset detection strategy is used for abnormal security access detection, and the third preset detection strategy is used for UDS message context detection.

[0133] As an optional implementation of the embodiment of the present disclosure, the acquisition module 410 is specifically configured to:

[0134] Receive CAN messages broadcast by the target electronic control unit;

[0135] Parsing the CAN message broadcast by the target electronic control unit to obtain a corresponding UDS message; the UDS message carries a diagnostic request message; the diagnostic request message includes: a first diagnostic request message and a second diagnostic request message; the first diagnostic request message includes: a diagnostic service ID, an operation type of the diagnostic service, and diagnostic parameters; the second diagnostic request message includes: a diagnostic service ID and diagnostic parameters;

[0136] The message to be detected is obtained according to the type of the diagnosis request message carried by the UDS message.

[0137] As an optional implementation of the embodiment of the present disclosure, when the preset detection strategy is the first preset detection strategy, the analysis module 420 is specifically configured to:

[0138] When the diagnostic request message carried by the UDS message is a first diagnostic request message, obtaining a target diagnostic service ID and a target diagnostic service operation type according to the message to be detected;

[0139] When it is detected that the target diagnostic service ID is the first diagnostic service ID, detecting whether the target diagnostic service operation type belongs to any one of the first diagnostic service operation type, the second diagnostic service operation type, and the third diagnostic service operation type;

[0140] If the target diagnostic service operation type belongs to any one of the first diagnostic service operation type, the second diagnostic service operation type, and the third diagnostic service operation type, determining that the session control of the target electronic control unit is normal;

[0141] Otherwise, the number of abnormal behaviors is recorded by a counter. When the number of abnormal behaviors is greater than a preset number of behaviors, it is determined that the target electronic control unit is attacked.

[0142] As an optional implementation of the embodiment of the present disclosure, when the preset detection strategy is the second preset detection strategy, the analysis module 420 includes:

[0143] an acquiring unit, configured to acquire a target diagnostic service ID and a target diagnostic service operation type according to the message to be detected when the diagnostic request message carried by the UDS message is a first diagnostic request message;

[0144] a detection unit, configured to detect whether a response of a target electronic control unit is a negative response when the target diagnostic service ID carried by the message to be detected is the second diagnostic service ID and the target diagnostic service operation type is the first diagnostic service operation type;

[0145] The determining unit is configured to determine that the security access of the target electronic control unit is abnormal if it is detected that the number of negative responses returned by the target electronic control unit to the test equipment exceeds a threshold number within a preset time period.

[0146] As an optional implementation of the embodiment of the present disclosure, the detection unit is specifically configured to:

[0147] Receive a message to be tested sent by a test device; the message to be tested carries a target diagnostic service ID, a target diagnostic service operation type, and a first request seed;

[0148] Encrypting the first request seed according to a random number generation algorithm to generate a second request seed;

[0149] sending the second request seed to the test device, so that the test device encrypts the second request seed according to a random number generation algorithm to generate a first key, and sends the target diagnostic service ID, the target diagnostic service operation type, and the first key to a target electronic control unit;

[0150] receiving the target diagnostic service ID, the target diagnostic service operation type, and the first key, and verifying the first key according to the local key;

[0151] If the local key is consistent with the first key, sending a positive response to the test device;

[0152] If the local key is inconsistent with the first key, a negative response is sent to the test device.

[0153] As an optional implementation of the embodiment of the present disclosure, when the preset detection strategy is the third preset detection strategy, the analysis module 420 is configured to:

[0154] According to the message to be detected, a CAN message corresponding to the message to be detected is obtained; the CAN message carries a CAN message ID and a first signal value; the first signal value represents a configurable signal value in the CAN message;

[0155] Determine whether a UDS message injection operation is performed according to the CAN message ID and the first signal value.

[0156] As an optional implementation of the embodiment of the present disclosure, the device further includes:

[0157] The parameter setting module is used to set the parameters of the configuration file; the parameters of the configuration file include: preset behavior times, threshold times, CAN message ID, first signal value, and UDS message ID range.

[0158] The intrusion detection device based on the UDS protocol provided by the embodiment of the present disclosure first obtains the message to be detected, and then detects the message to be detected according to the preset detection strategy to obtain the detection result. Since the message to be detected is a UDS message obtained based on the parsing of the CAN message, and the preset detection strategy includes a strategy for detecting abnormal session control, a strategy for detecting abnormal security access, and a strategy for detecting context anomalies of the UDS message, it is possible to detect the UDS message according to the protocol characteristics of the UDS message and three different usage scenarios, thereby expanding the detection range and making up for the defect that the existing technology cannot detect anomalies based on the UDS protocol characteristics, so that it can timely detect attackers who achieve their attack purposes by injecting UDS messages, thereby ensuring the safety of vehicles and drivers.

[0159] For the specific definition of the intrusion detection device based on the UDS protocol, please refer to the definition of the intrusion detection method based on the UDS protocol above, which will not be repeated here. The various modules in the above-mentioned intrusion detection device based on the UDS protocol can be implemented in whole or in part through software, hardware, or a combination thereof. The above-mentioned modules can be embedded in or independent of the processor of the electronic device in the form of hardware, or can be stored in the processor of the electronic device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0160] The present disclosure also provides an electronic device, Figure 5 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. Figure 5 As shown, the electronic device provided in this embodiment includes: a memory 51 and a processor 52. The memory 51 is used to store a computer program; the processor 52 is used to execute the steps of any of the embodiments of the UDS protocol-based intrusion detection method provided in the above-mentioned method embodiments when the computer program is invoked. The electronic device includes a processor, memory, a communication interface, a display screen, and an input device connected via a system bus. The processor of the electronic device provides computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. When the computer program is executed by the processor, an intrusion detection method based on the UDS protocol is implemented. The display screen of the electronic device can be a liquid crystal display or an electronic ink display. The input device of the electronic device can be a touch layer covering the display screen, keys, a trackball, or a touchpad provided on the computer device housing, or an external keyboard, touchpad, or mouse.

[0161] Those skilled in the art will understand that Figure 5The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of the present disclosure, and does not constitute a limitation on the computer device to which the scheme of the present disclosure is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0162] In one embodiment, the intrusion detection device based on the UDS protocol provided by the present disclosure can be implemented in the form of a computer, and the computer program can be used in Figure 5 The memory of the electronic device may store various program modules constituting the intrusion detection device based on the UDS protocol of the electronic device, such as: Figure 4 The acquisition module 410 and the analysis module 420 shown in FIG. The computer program composed of various program modules enables the processor to execute the steps of the intrusion detection method based on the UDS protocol for an electronic device of various embodiments of the present disclosure described in this specification.

[0163] An embodiment of the present disclosure further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the intrusion detection method based on the UDS protocol provided in the above method embodiment is implemented.

[0164] Those skilled in the art will appreciate that embodiments of the present disclosure may be provided as methods, systems, or computer program products. Thus, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code.

[0165] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0166] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0167] Computer-readable media includes both permanent and non-permanent, removable and non-removable storage media. Storage media can implement any method or technology for storing information, which can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change RAM (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media, such as modulated data signals and carrier waves.

[0168] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0169] The foregoing description is intended only to provide specific embodiments of the present disclosure, intended to enable those skilled in the art to understand and implement the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the embodiments described herein, but rather to be construed in the broadest manner consistent with the principles and novel features disclosed herein.

Claims

1. An intrusion detection method based on the UDS protocol, characterized in that: include: Obtaining a message to be detected; the message to be detected is a unified diagnostic service UDS message obtained based on controller area network CAN message parsing; Detect the message to be detected according to a preset detection strategy and obtain a detection result; The preset detection strategy includes: a first preset detection strategy, a second preset detection strategy, and a third preset detection strategy; the first preset detection strategy is used for abnormal session control detection, the second preset detection strategy is used for abnormal security access detection, and the third preset detection strategy is used for abnormal context detection of UDS messages; The obtaining of the message to be detected includes: Receive CAN messages broadcast by the target electronic control unit; Parsing the CAN message broadcast by the target electronic control unit to obtain a corresponding UDS message; the UDS message carries a diagnostic request message; the diagnostic request message includes: a first diagnostic request message and a second diagnostic request message; the first diagnostic request message includes: a diagnostic service ID, an operation type of the diagnostic service, and diagnostic parameters; the second diagnostic request message includes: a diagnostic service ID and diagnostic parameters; Obtaining a message to be detected according to the type of the diagnostic request message carried by the UDS message; When the preset detection strategy is the first preset detection strategy, detecting the message to be detected according to the preset detection strategy to obtain a detection result includes: When the diagnostic request message carried by the UDS message is a first diagnostic request message, obtaining a target diagnostic service ID and a target diagnostic service operation type according to the message to be detected; When it is detected that the target diagnostic service ID is the first diagnostic service ID, detecting whether the target diagnostic service operation type belongs to any one of the first diagnostic service operation type, the second diagnostic service operation type, and the third diagnostic service operation type; If the target diagnostic service operation type belongs to any one of the first diagnostic service operation type, the second diagnostic service operation type, and the third diagnostic service operation type, determining that the session control of the target electronic control unit is normal; Otherwise, the number of abnormal behaviors is recorded by a counter. When the number of abnormal behaviors is greater than a preset number of behaviors, it is determined that the target electronic control unit is attacked.

2. The method according to claim 1, characterized in that When the preset detection strategy is the second preset detection strategy, detecting the message to be detected according to the preset detection strategy to obtain a detection result includes: When the diagnostic request message carried by the UDS message is a first diagnostic request message, obtaining a target diagnostic service ID and a target diagnostic service operation type according to the message to be detected; When the target diagnostic service ID carried by the message to be detected is the second diagnostic service ID and the target diagnostic service operation type is the first diagnostic service operation type, detecting whether the response of the target electronic control unit is a negative response; If it is detected that the number of negative responses returned by the target electronic control unit to the test equipment exceeds a threshold number within a preset time period, it is determined that the security access of the target electronic control unit is abnormal.

3. The method according to claim 2, characterized in that The detecting whether the response of the target electronic control unit is a negative response includes: Receive a message to be tested sent by a test device; the message to be tested carries a target diagnostic service ID, a target diagnostic service operation type, and a first request seed; Encrypting the first request seed according to a random number generation algorithm to generate a second request seed; sending the second request seed to the test device, so that the test device encrypts the second request seed according to a random number generation algorithm to generate a first key, and sends the target diagnostic service ID, the target diagnostic service operation type, and the first key to a target electronic control unit; receiving the target diagnostic service ID, the target diagnostic service operation type, and the first key, and verifying the first key according to the local key; If the local key is consistent with the first key, sending a positive response to the test device; If the local key is inconsistent with the first key, a negative response is sent to the test device.

4. The method according to claim 1, wherein When the preset detection strategy is the third preset detection strategy, detecting the message to be detected according to the preset detection strategy to obtain a detection result includes: According to the message to be detected, a CAN message corresponding to the message to be detected is obtained; the CAN message carries a CAN message ID and a first signal value; the first signal value represents a configurable signal value in the CAN message; Determine whether a UDS message injection operation is performed according to the CAN message ID and the first signal value.

5. The method according to claim 1, wherein Before obtaining the message to be detected, the method further includes: Set the parameters of the configuration file; the parameters of the configuration file include: preset behavior times, threshold times, CAN message ID, first signal value, and UDS message ID range.

6. An intrusion detection device based on the UDS protocol, characterized in that: include: An acquisition module, used to obtain the message to be detected; The message to be detected is a unified diagnostic service UDS message obtained based on controller area network CAN message analysis; An analysis module is used to detect the message to be detected according to a preset detection strategy and obtain a detection result; The preset detection strategy includes: a first preset detection strategy, a second preset detection strategy, and a third preset detection strategy; the first preset detection strategy is used for abnormal session control detection, the second preset detection strategy is used for abnormal security access detection, and the third preset detection strategy is used for UDS message context detection; The obtaining of the message to be detected includes: Receive CAN messages broadcast by the target electronic control unit; Parsing the CAN message broadcast by the target electronic control unit to obtain a corresponding UDS message; the UDS message carries a diagnostic request message; the diagnostic request message includes: a first diagnostic request message and a second diagnostic request message; the first diagnostic request message includes: a diagnostic service ID, an operation type of the diagnostic service, and diagnostic parameters; the second diagnostic request message includes: a diagnostic service ID and diagnostic parameters; Obtaining a message to be detected according to the type of the diagnostic request message carried by the UDS message; When the preset detection strategy is the first preset detection strategy, detecting the message to be detected according to the preset detection strategy to obtain a detection result includes: When the diagnostic request message carried by the UDS message is a first diagnostic request message, obtaining a target diagnostic service ID and a target diagnostic service operation type according to the message to be detected; When it is detected that the target diagnostic service ID is the first diagnostic service ID, detecting whether the target diagnostic service operation type belongs to any one of the first diagnostic service operation type, the second diagnostic service operation type, and the third diagnostic service operation type; If the target diagnostic service operation type belongs to any one of the first diagnostic service operation type, the second diagnostic service operation type, and the third diagnostic service operation type, determining that the session control of the target electronic control unit is normal; Otherwise, the number of abnormal behaviors is recorded by a counter. When the number of abnormal behaviors is greater than a preset number of behaviors, it is determined that the target electronic control unit is attacked.

7. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the intrusion detection method based on the UDS protocol according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the intrusion detection method based on the UDS protocol according to any one of claims 1 to 5 is implemented.

Images