Vehicle network attack analysis method, device, equipment and storage medium

Abstract

The present invention discloses a vehicle network attack analysis method, device, equipment and storage medium. The method comprises: performing layered decoding processing on vehicle network data based on a preset data processing layer to obtain layered network data, wherein the data processing layer comprises a network layer, a transport layer and an application layer; for the layered network data corresponding to each data processing layer, determining the target data information corresponding to the layered network data; determining the network attack vehicle data based on the target data information and a preset network attack rule set, wherein the network attack rule set comprises at least one network attack rule, which can improve the accuracy of vehicle network attack identification, enhance the vehicle network attack defense capability and improve the user experience.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a vehicle network attack analysis method, device, equipment and storage medium. Background Art

[0002] As vehicles become more intelligent and networked, information exchange between internal devices and between vehicles and external devices becomes more frequent. Correspondingly, cybersecurity attacks against vehicles will become more and more frequent.

[0003] Existing network attack analysis methods have many dependencies and can only be applied to standard operating systems. They are not universally applicable to vehicle controllers, and the network environment of vehicle controllers is complex, resulting in low accuracy in identifying network attacks, and consumes too much vehicle network resources, which cannot meet actual attack analysis needs and results in poor user experience. Summary of the invention

[0004] The present invention provides a vehicle network attack analysis method, device, equipment and storage medium to improve the accuracy of vehicle network attack identification, enhance the vehicle network attack defense capability, and improve the user experience.

[0005] According to one aspect of the present invention, a vehicle network attack analysis method is provided. The method comprises:

[0006] Based on a preset data processing layer, the vehicle network data is decoded and processed in layers to obtain layered network data, wherein the data processing layer includes a network layer, a transport layer and an application layer;

[0007] For each of the layered network data corresponding to the data processing layer, determining target data information corresponding to the layered network data;

[0008] The network attack vehicle data is determined based on the target data information and a preset network attack rule set, wherein the network attack rule set includes at least one network attack rule.

[0009] According to another aspect of the present invention, a vehicle network attack analysis device is provided. The device comprises:

[0010] A layered network data acquisition module, used to perform layered decoding processing on the vehicle network data based on a preset data processing layer to obtain layered network data, wherein the data processing layer includes a network layer, a transport layer and an application layer;

[0011] A target data information determination module, used for determining the target data information corresponding to the layered network data for each layered network data corresponding to the data processing layer;

[0012] A network attack vehicle data determination module is used to determine the network attack vehicle data based on the target data information and a preset network attack rule set, wherein the network attack rule set includes at least one network attack rule.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the vehicle network attack analysis method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the vehicle network attack analysis method described in any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention obtains layered network data by performing layered decoding processing on the vehicle network data based on a preset data processing layer, wherein the data processing layer includes a network layer, a transport layer, and an application layer. For each layered network data corresponding to the data processing layer, the target data information corresponding to the layered network data is determined. Based on the target data information and a preset network attack rule set, the network attack vehicle data is determined, thereby improving the accuracy of vehicle network attack identification, enhancing the vehicle network attack defense capability, and thus improving the user experience.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 is a flow chart of a vehicle network attack analysis method provided according to Embodiment 1 of the present invention;

[0022] Figure 2 is a flowchart of a vehicle network attack analysis method provided according to Embodiment 2 of the present invention;

[0023] Figure 3 is a structural diagram of a vehicle network attack analysis device provided according to Embodiment 3 of the present invention;

[0024] Figure 4 It is a structural diagram of an electronic device for implementing the vehicle network attack analysis method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Embodiment 1

[0028] Figure 1 A flowchart of a vehicle network attack analysis method is provided for the first embodiment of the present invention. This embodiment is applicable to the case where the vehicle Ethernet message flow is analyzed to determine the network attack data. The method can be executed by a vehicle network attack analysis device. The vehicle network attack analysis device can be implemented in the form of hardware and / or software. The vehicle network attack analysis device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0029] S101. Perform layered decoding processing on the vehicle network data based on a preset data processing layer to obtain layered network data.

[0030] The data processing layer may refer to the network processing protocol layer. The data processing layer includes the network layer, the transport layer and the application layer. The vehicle network data may refer to the network data acquired by the vehicle. The layered network data may refer to the network data corresponding to each data processing layer.

[0031] Specifically, according to the preset data processing layer, the acquired vehicle network data is subjected to layered decoding processing to obtain layered network data corresponding to each data processing layer.

[0032] Exemplarily, the step of performing hierarchical decoding processing on the vehicle network data based on a preset data processing layer to obtain hierarchical network data includes:

[0033] The vehicle network data is subjected to network layer decoding processing to obtain layered network data of the network layer; the layered network data of the network layer is subjected to transport layer decoding processing to obtain layered network data of the transport layer; the layered network data of the transport layer is subjected to application layer decoding processing to obtain layered network data of the application layer.

[0034] It should be noted that the layered decoding process of each data processing layer is different, and the layered decoding process may include network layer decoding process, transport layer decoding process and application layer decoding process. Specifically, the network layer layered network data can be obtained by performing network layer decoding process on the vehicle network data. The layered network data of the network layer can be obtained by performing transport layer decoding process on the layered network data of the network layer. The layered network data of the transport layer can be obtained by performing application layer decoding process on the layered network data of the application layer.

[0035] S102: For each of the layered network data corresponding to the data processing layer, determine target data information corresponding to the layered network data.

[0036] The target data information may refer to network data information used to determine a network attack.

[0037] Specifically, the layered network data of the network layer is subjected to data analysis and processing to obtain the target data information corresponding to the network layer. The layered network data of the transport layer is subjected to data analysis and processing to obtain the target data information corresponding to the transport layer. The layered network data of the application layer is subjected to data analysis and processing to obtain the target data information corresponding to the application layer.

[0038] For example, the data parsing process of the network layer hierarchical network data may include, but is not limited to: calculating the data length of the ICMP (Internet Control Message Protocol) of the network layer hierarchical network data. The data analysis and processing of the transport layer layered network data may include but is not limited to: counting the number of transport layer layered network data connection times, counting according to the transport layer layered network data port number, determining the source port and destination address port of the transport layer layered network data, counting the number of transport layer layered network data TCP (Transmission Control Protocol) flags, counting the number of transport layer layered network data ACK (Acknowledge character) Flags, counting the number of transport layer layered network data RESET Flags, counting the number of transport layer layered network data SYN (Synchronize Sequence Numbers) Flags, counting the number of transport layer layered network data FIN Flags, counting the number of transport layer layered network data PUSH Flags, counting the number of transport layer layered network data URGENT Flags, etc., counting the number of FIN Flags and the number of RESET Flags, counting the number of FIN Flags and the number of SYN Flags, counting the number of SYNFlags and the number of ACK Flags, counting the number of PUSH Flags and the number of ACK Flags, and counting the number of RESET Flags and the number of ACK Flags.

[0039] Exemplarily, for the layered network data corresponding to each of the data processing layers, determining the target data information corresponding to the layered network data includes: determining the parsing protocol corresponding to each of the data processing layers; for the layered network data corresponding to each of the data processing layers, performing protocol parsing processing on the layered network data based on the parsing protocol corresponding to the data processing layer to obtain key data information corresponding to the vehicle network data; performing data parsing processing on the key data information to determine the target data information corresponding to the key data information.

[0040] Among them, the key data information may refer to important data in the vehicle network data, that is, valid data in the vehicle network data.

[0041] Specifically, determine the parsing protocol corresponding to each of the data processing layers. Exemplarily, the parsing protocol may include a network layer parsing protocol, a transport layer parsing protocol, and an application layer parsing protocol. For example, the network layer parsing process may include an ICMP parsing process. The transport layer parsing process may include a TCP parsing process and a UDP parsing process. The application layer parsing process may include an HTTP parsing process. Based on the network layer parsing protocol, the network layer network data is subjected to a network layer protocol parsing process to obtain network layer key data information corresponding to the network layer protocol. Based on the transport layer parsing protocol, the transport layer network data is subjected to a transport layer protocol parsing process to obtain transport layer key data information corresponding to the transport layer protocol. Based on the application layer parsing protocol, the application layer network data is subjected to an application layer protocol parsing process to obtain application layer key data information corresponding to the application layer protocol. Perform data parsing on the key data information corresponding to each of the data processing layers to determine the target data information corresponding to the key data information.

[0042] S103: Determine network attack vehicle data based on the target data information and a preset network attack rule set.

[0043] The network attack rule set includes at least one network attack rule. The network attack rule set includes a network layer network attack rule set, a transport layer network attack rule set and an application layer network attack rule set.

[0044] In an embodiment of the present invention, the target data information corresponding to each data processing layer and the preset network attack rule set can be matched with the preset network attack rule set to determine the network attack vehicle data. Specifically, the network layer target data information is matched with the network layer network attack rule set to determine the network attack vehicle data that matches the network layer network attack rule set. The transport layer target data information is matched with the transport layer network attack rule set to determine the network attack vehicle data that matches the transport layer network attack rule set. The application layer target data information is matched with the application layer network attack rule set to determine the network attack vehicle data that matches the application layer network attack rule set.

[0045] Exemplarily, for the target data information corresponding to the network layer, the determining of the network attack vehicle data based on the target data information and a preset network attack rule set includes at least one of the following operations: when the Internet Protocol message fragmentation of the target data information is not equal to the message fragmentation actually obtained, the target data information corresponding to the network layer is determined as the network attack vehicle data; when the Internet Protocol message header protocol number of the target data information does not match the actual protocol, the target data information corresponding to the network layer is determined as the network attack vehicle data; when the synchronization sequence number of the same identity identifier of the target data information appears repeatedly, the target data information corresponding to the network layer is determined as the network attack vehicle data.

[0046] Specifically, determining the network attack vehicle data according to the target data information corresponding to the network layer and the preset network attack rule set may include at least one of the following operations: when the Internet Protocol message fragmentation of the target data information is not equal to the message fragmentation actually obtained, determining the network attack type as a fragmentation attack, and determining the target data information corresponding to the network layer as network attack vehicle data. When the Internet Protocol message header protocol number of the target data information does not match the actual protocol, determining the network attack type as a protocol forgery attack, and determining the target data information corresponding to the network layer as network attack vehicle data. When the synchronization sequence number of the same identity identifier of the target data information appears repeatedly, determining the network attack type as a SYN attack, and determining the target data information corresponding to the network layer as network attack vehicle data.

[0047] Exemplarily, for the target data information corresponding to the transport layer, the determining of the network attack vehicle data based on the target data information and a preset network attack rule set includes at least one of the following operations: when the destination port number of the target data information source exceeds the preset port number, the target data information corresponding to the transport layer is determined as network attack vehicle data; when the target data information confirmation characters are discontinuous, the target data information corresponding to the transport layer is determined as network attack vehicle data; when the message count growth rate of the target data information is less than or equal to a preset speed, the target data information corresponding to the transport layer is determined as network attack vehicle data; when the message length of the target data information is less than a preset length threshold, the target data information corresponding to the transport layer is determined as network attack vehicle data.

[0048] Specifically, determining the network attack vehicle data according to the target data information corresponding to the transport layer and the preset network attack rule set may include at least one of the following operations: when the destination port number of the target data information source exceeds the preset port number, determining the network attack type as an abnormal port attack, and determining the target data information corresponding to the transport layer as network attack vehicle data. When the target data information confirms that the characters are discontinuous, determining the network attack type as disorder, and determining the target data information corresponding to the transport layer as network attack vehicle data. When the message count growth rate of the target data information is less than or equal to the preset speed, determining it as a UDP flood attack, and determining the target data information corresponding to the transport layer as network attack vehicle data. When the message length of the target data information is less than the preset length threshold, determining the network attack type as a deformed message attack, and determining the target data information corresponding to the transport layer as network attack vehicle data.

[0049] Exemplarily, for the target data information corresponding to the application layer, determining the network attack vehicle data based on the target data information and a preset network attack rule set includes at least one of the following operations: when the target data information does not contain preset characteristic data information, determining the target data information corresponding to the application layer as network attack vehicle data; when the target data information does not define a request method, determining the target data information corresponding to the application layer as network attack vehicle data.

[0050] Specifically, determining the network attack vehicle data according to the target data information corresponding to the application layer and the preset network attack rule set may include at least one of the following operations: when the target data information does not contain preset characteristic data information, determining that the content of the target data information system file HOST is forged, that is, the network attack type is a phishing attack, and determining the target data information corresponding to the application layer as the network attack vehicle data. When the target data information does not define a request method, determining that the network attack type is an abnormal attack, and determining the target data information corresponding to the application layer as the network attack vehicle data.

[0051] The technical solution of the embodiment of the present invention obtains layered network data by performing layered decoding processing on the vehicle network data based on a preset data processing layer, wherein the data processing layer includes a network layer, a transport layer, and an application layer. For each layered network data corresponding to the data processing layer, the target data information corresponding to the layered network data is determined. Based on the target data information and a preset network attack rule set, the network attack vehicle data is determined, thereby improving the accuracy of vehicle network attack identification, enhancing the vehicle network attack defense capability, and thus improving the user experience.

[0052] On the basis of the above embodiments, the method further includes: when the network attack vehicle data does not exist in the vehicle network data, sending the vehicle network data to the vehicle terminal for application.

[0053] Specifically, after comparing the contents of the preset data processing layer with the network attack rule set, if it is determined that the network attack vehicle-machine data does not exist in the vehicle-machine network data, the vehicle-machine network data is sent to the vehicle-machine terminal of the vehicle, the vehicle-machine network data is processed and applied.

[0054] Exemplarily, the method may also include: updating the rule parameters in the network attack rule set in real time based on the feedback results of the vehicle controller detection engine. Specifically, after cooperating with the controller network data analysis detection engine, according to the upload results of the controller detection engine, the rule parameters in the network attack rule set are dynamically adjusted in real time, and the parameter settings of the rule parameters are accurately controlled by feedback to achieve network attack detection and application protocol identification applicable to multiple networks and multiple hardware devices, thereby improving the accuracy of vehicle network attack identification, enhancing the vehicle network attack defense capability, and improving user experience.

[0055] Embodiment 2

[0056] Figure 2 This is a flowchart of a vehicle network attack analysis method provided by Embodiment 2 of the present invention. This embodiment is a preferred solution based on the above embodiments. Figure 2 As shown, the method includes:

[0057] According to the preset data processing layer, the vehicle network data is decoded at the network layer to obtain the layered network data of the network layer; the layered network data of the network layer is decoded at the transport layer to obtain the layered network data of the transport layer; the layered network data of the transport layer is decoded at the application layer to obtain the layered network data of the application layer.

[0058] Based on the network layer parsing protocol, the network layer network data is subjected to network layer protocol parsing to obtain network layer key data information corresponding to the network layer. Based on the transport layer parsing protocol, the transport layer network data is subjected to transport layer protocol parsing to obtain transport layer key data information corresponding to the transport layer. Based on the application layer parsing protocol, the application layer network data is subjected to application layer protocol parsing to obtain application layer key data information corresponding to the application layer.

[0059] The network layer key data information is subjected to data analysis and processing to obtain the network layer target data information corresponding to the network layer; the transport layer key data information is subjected to data analysis and processing to obtain the transport layer target data information corresponding to the transport layer; the application layer key data information is subjected to data analysis and processing to obtain the application layer target data information corresponding to the application layer.

[0060] The network layer target data information is compared with the network layer network attack rule set to determine the network attack identification result. The transport layer target data information is compared with the transport layer network attack rule set to determine the network attack identification result. The application layer target data information is compared with the application layer network attack rule set to determine the network attack identification result.

[0061] Embodiment 3

[0062] Figure 3 This is a structural diagram of a vehicle network attack analysis device provided by Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a hierarchical network data acquisition module 301, a target data information determination module 302 and a network attack vehicle data determination module 303.

[0063] A layered network data acquisition module 301 is used to perform layered decoding processing on-board network data based on a preset data processing layer to obtain layered network data, wherein the data processing layer includes a network layer, a transport layer and an application layer; a target data information determination module 302 is used to determine the target data information corresponding to the layered network data corresponding to each of the layered network data corresponding to the data processing layer; a network attack on-board data determination module 303 is used to determine the network attack on-board data based on the target data information and a preset network attack rule set, wherein the network attack rule set includes at least one network attack rule.

[0064] The technical solution of the embodiment of the present invention obtains layered network data by performing layered decoding processing on the vehicle network data based on a preset data processing layer, wherein the data processing layer includes a network layer, a transport layer, and an application layer. For each layered network data corresponding to the data processing layer, the target data information corresponding to the layered network data is determined. Based on the target data information and a preset network attack rule set, the network attack vehicle data is determined, thereby improving the accuracy of vehicle network attack identification, enhancing the vehicle network attack defense capability, and thus improving the user experience.

[0065] Based on the above embodiment, the layered network data acquisition module 301 can be specifically used for:

[0066] The vehicle network data is subjected to network layer decoding processing to obtain layered network data of the network layer; the layered network data of the network layer is subjected to transport layer decoding processing to obtain layered network data of the transport layer; the layered network data of the transport layer is subjected to application layer decoding processing to obtain layered network data of the application layer.

[0067] Based on the above embodiment, the target data information determination module 302 can be specifically used for:

[0068] Determine the parsing protocol corresponding to each of the data processing layers; for the layered network data corresponding to each of the data processing layers, perform protocol parsing on the layered network data based on the parsing protocol corresponding to the data processing layer to obtain key data information corresponding to the vehicle network data; perform data parsing on the key data information to determine the target data information corresponding to the key data information.

[0069] On the basis of the above embodiment, for the target data information corresponding to the network layer, determining the network attack vehicle data based on the target data information and a preset network attack rule set includes at least one of the following operations:

[0070] When the Internet Protocol message fragmentation of the target data information is not equal to the message fragmentation actually obtained, the target data information corresponding to the network layer is determined as network attack vehicle data; when the Internet Protocol message header protocol number of the target data information does not match the actual protocol, the target data information corresponding to the network layer is determined as network attack vehicle data; when the synchronization sequence number of the same identity identifier of the target data information appears repeatedly, the target data information corresponding to the network layer is determined as network attack vehicle data.

[0071] On the basis of the above embodiment, for the target data information corresponding to the transport layer, determining the network attack vehicle data based on the target data information and a preset network attack rule set includes at least one of the following operations:

[0072] In the case where the destination port number of the target data information source exceeds the preset port number, the target data information corresponding to the transport layer is determined as network attack vehicle computer data; in the case where the target data information confirmation characters are discontinuous, the target data information corresponding to the transport layer is determined as network attack vehicle computer data; in the case where the message count growth rate of the target data information is less than or equal to the preset speed, the target data information corresponding to the transport layer is determined as network attack vehicle computer data;

[0073] When the message length of the target data information is less than a preset length threshold, the target data information corresponding to the transport layer is determined as network attack vehicle computer data.

[0074] On the basis of the above embodiment, for the target data information corresponding to the application layer, determining the network attack vehicle data based on the target data information and a preset network attack rule set includes at least one of the following operations:

[0075] When the target data information does not contain preset characteristic data information, the target data information corresponding to the application layer is determined as network attack vehicle data; when the target data information does not define a request method, the target data information corresponding to the application layer is determined as network attack vehicle data.

[0076] Based on the above embodiment, the device further includes: a vehicle network data application module, wherein the vehicle network data application module can be used to send the vehicle network data to the vehicle terminal for application when the network attack vehicle data does not exist in the vehicle network data.

[0077] The vehicle network attack analysis device provided in the embodiment of the present invention can execute the vehicle network attack analysis method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0078] Embodiment 4

[0079] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0080] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0081] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0082] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the method of vehicle network attack analysis.

[0083] In some embodiments, the method vehicle network attack analysis may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method vehicle network attack analysis described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the method vehicle network attack analysis in any other suitable manner (e.g., by means of firmware).

[0084] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0085] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0086] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0087] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0088] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0089] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0090] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0091] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A vehicle network attack analysis method, characterized in that: include: Based on a preset data processing layer, the vehicle network data is decoded and processed in layers to obtain layered network data, wherein the data processing layer includes a network layer, a transport layer and an application layer; For each of the layered network data corresponding to the data processing layer, determining target data information corresponding to the layered network data; Determine the network attack vehicle data based on the target data information and a preset network attack rule set, wherein the network attack rule set includes at least one network attack rule, the network attack rule set includes a network layer network attack rule set, a transport layer network attack rule set and an application layer network attack rule set, and the rule parameters of the network attack rule are updated in real time based on the feedback result of the vehicle controller detection engine; Wherein, determining the network attack vehicle computer data according to the target data information corresponding to the network layer and the network attack rule set of the network layer includes at least one of the following operations: In the case where the Internet protocol message fragment of the target data information is not equal to the message fragment actually obtained, determining the network attack type as a fragment attack, and determining the target data information corresponding to the network layer as network attack vehicle data; In the case where the protocol number of the Internet protocol message header of the target data information does not match the actual protocol, determining the network attack type as a protocol forgery attack, and determining the target data information corresponding to the network layer as network attack vehicle data; When the synchronization sequence number of the same identity identifier in the target data information appears repeatedly, the network attack type is determined to be a SYN attack, and the target data information corresponding to the network layer is determined to be network attack vehicle data.

2. The method according to claim 1, characterized in that The method of performing layered decoding processing on the vehicle network data based on the preset data processing layer to obtain layered network data includes: Performing network layer decoding processing on the vehicle network data to obtain hierarchical network data of the network layer; Performing transport layer decoding processing on the layered network data of the network layer to obtain layered network data of the transport layer; The layered network data of the transport layer is subjected to application layer decoding processing to obtain layered network data of the application layer.

3. The method according to claim 1, characterized in that The step of determining target data information corresponding to the layered network data for each of the data processing layers includes: Determine the parsing protocol corresponding to each of the data processing layers; For the layered network data corresponding to each of the data processing layers, based on the parsing protocol corresponding to the data processing layer, the layered network data is subjected to protocol parsing processing to obtain key data information corresponding to the vehicle network data; The key data information is subjected to data analysis and processing to determine target data information corresponding to the key data information.

4. The method according to claim 1, characterized in that: For the target data information corresponding to the transport layer, determining the network attack vehicle data based on the target data information and a preset network attack rule set includes at least one of the following operations: When the destination port number of the target data information source exceeds the preset port number, the target data information corresponding to the transport layer is determined as network attack vehicle computer data; In the case where the target data information confirms that the characters are discontinuous, the target data information corresponding to the transport layer is determined as network attack vehicle computer data; When the message count growth rate of the target data information is less than or equal to the preset speed, the target data information corresponding to the transport layer is determined as network attack vehicle data; When the message length of the target data information is less than a preset length threshold, the target data information corresponding to the transport layer is determined as network attack vehicle computer data.

5. The method according to claim 1, characterized in that For the target data information corresponding to the application layer, determining the network attack vehicle data based on the target data information and a preset network attack rule set includes at least one of the following operations: In the case where the target data information does not contain preset characteristic data information, determining the target data information corresponding to the application layer as network attack vehicle data; In the case that the target data information does not define a request method, the target data information corresponding to the application layer is determined as network attack vehicle data.

6. The method according to claim 1, characterized in that The method further comprises: In a case where the network attack vehicle computer data does not exist in the vehicle computer network data, the vehicle computer network data is sent to the vehicle computer terminal for application.

7. A vehicle network attack analysis device, characterized in that: include: A layered network data acquisition module, used to perform layered decoding processing on the vehicle network data based on a preset data processing layer to obtain layered network data, wherein the data processing layer includes a network layer, a transport layer and an application layer; A target data information determination module, used for determining the target data information corresponding to the layered network data for each layered network data corresponding to the data processing layer; A network attack vehicle data determination module, used to determine the network attack vehicle data based on the target data information and a preset network attack rule set, wherein the network attack rule set includes at least one network attack rule, and the network attack rule set includes a network layer network attack rule set, a transport layer network attack rule set and an application layer network attack rule set, and the rule parameters of the network attack rule are updated in real time based on the feedback result of the vehicle controller detection engine; Wherein, determining the network attack vehicle computer data according to the target data information corresponding to the network layer and the network attack rule set of the network layer includes at least one of the following operations: In the case where the Internet protocol message fragment of the target data information is not equal to the message fragment actually obtained, determining the network attack type as a fragment attack, and determining the target data information corresponding to the network layer as network attack vehicle data; In the case where the protocol number of the Internet protocol message header of the target data information does not match the actual protocol, determining the network attack type as a protocol forgery attack, and determining the target data information corresponding to the network layer as network attack vehicle data; When the synchronization sequence number of the same identity identifier in the target data information appears repeatedly, the network attack type is determined to be a SYN attack, and the target data information corresponding to the network layer is determined to be network attack vehicle data.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the vehicle network attack analysis method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the vehicle network attack analysis method according to any one of claims 1 to 6 when executed.

Images