Security detection methods, devices, equipment and storage media for vehicle-to-everything (V2X) communication data

Abstract

This application relates to a method, apparatus, device, and storage medium for security detection of vehicle-to-everything (V2X) communication data. The method includes: acquiring communication data between a vehicle under test and a server; extracting Transport Layer Security (TLS) data packets and Hypertext Transfer Protocol (HTP) data packets from the communication data; extracting data encryption algorithms and certificate signing algorithms from the TLS data packets; and extracting plaintext links from the HTP data packets; and determining the security of the communication data based on the data encryption algorithms, certificate signing algorithms, and plaintext links. The security detection method of this invention extracts data encryption algorithms, certificate signing algorithms, and plaintext links from the communication data more deeply, and determines the security of the communication data based on the security of these three components. This results in high accuracy in security detection.

Description

Technical Field

[0001] This application relates to the field of vehicle-to-everything (V2X) communication, and in particular to a method, apparatus, device, and storage medium for secure detection of V2X communication data. Background Technology

[0002] Currently, most methods for security detection of vehicle network transport layer protocol traffic can only perform a simple check on the transport layer security protocol version, determining whether it is secure by checking the transport layer protocol version information used.

[0003] However, judging the security of vehicle-to-everything (V2X) communication solely based on the version information of the transport layer security protocol typically has significant limitations, or rather, low accuracy. To improve the accuracy of security detection, in-depth analysis of V2X communication data is necessary. However, currently, there is no automated method in the V2X field capable of performing in-depth analysis of communication data for security detection. Manually examining the deep characteristics of communication data is not only inefficient but also consumes substantial human resources.

[0004] There is currently no effective solution to the problem of low detection accuracy of security detection methods for vehicle network transport layer protocol traffic. Summary of the Invention

[0005] This invention provides a method, apparatus, device, and storage medium for secure detection of vehicle network communication data, in order to solve the problem of low detection accuracy of current secure detection methods for vehicle network transport layer protocol traffic.

[0006] In a first aspect, the present invention provides a method for secure detection of vehicle-to-everything (V2X) communication data, the method comprising:

[0007] Acquire communication data between the vehicle under test and the server;

[0008] Extract Transport Layer Security (TLS) data packets and Hypertext Transfer Protocol (HTTP) data packets from the communication data;

[0009] Extract data encryption algorithms and certificate signing algorithms from the Transport Layer Security Protocol (TLS) data packets, and extract plaintext links from the Hypertext Transfer Protocol (HTTP) data packets;

[0010] The security of the communication data is determined based on the data encryption algorithm, the certificate signing algorithm, and the plaintext link.

[0011] In some embodiments, the data encryption algorithm and certificate signing algorithm extracted from the transport layer security protocol data packet include:

[0012] The data encryption algorithm is extracted from the transport layer security protocol data packet based on the field identifier of the data encryption algorithm.

[0013] The certificate signing algorithm is extracted from the transport layer security protocol data packet based on the field identifier of the certificate signing algorithm.

[0014] In some embodiments, extracting the plaintext link from the Hypertext Transfer Protocol data packet includes:

[0015] The parameter type, parameter content, and website address are obtained from the Hypertext Transfer Protocol data packet, and the plaintext link is determined based on the parameter type, parameter content, and website address.

[0016] In some embodiments, determining the security of the communication data based on the data encryption algorithm, the certificate signing algorithm, and the plaintext link includes:

[0017] The field features of the data encryption algorithm are matched with a preset first database, and the security of the data encryption algorithm is determined based on the matching results.

[0018] The field features of the certificate signing algorithm are matched with a preset second database, and the security of the certificate signing algorithm is determined based on the matching results.

[0019] The security of the communication data is determined based on the security of the data encryption algorithm, the security of the certificate signing algorithm, and the plaintext link.

[0020] In some embodiments, the method further includes:

[0021] Acquire the data streams flowing into and out of the vehicle under test;

[0022] From the data stream, identify the target data stream containing Uniform Resource Locator (URL) characteristics, and from the target data stream, identify the malicious data stream containing attack characteristics;

[0023] The malicious host address is determined based on the malicious data stream.

[0024] In some embodiments, determining a malicious data stream containing attack signatures from the target data stream includes:

[0025] For the target data stream flowing into the vehicle under test, the attack commands in the target data stream are detected, and the target data stream containing the attack commands is identified as a malicious data stream.

[0026] For the target data stream flowing out of the vehicle under test, the attack tool field in the target data stream is detected, and the target data stream containing the attack tool field is identified as a malicious data stream.

[0027] In some embodiments, the method further includes:

[0028] The malicious host address is fed back to the vehicle under test, and a blacklist mechanism is established in the firewall to block attacks from the malicious host address.

[0029] Secondly, this invention provides a security detection device for vehicle network communication data, the device comprising:

[0030] The data acquisition module is used to acquire communication data between the vehicle under test and the server.

[0031] The first extraction module is used to extract Transport Layer Security Protocol (TLS) data packets and Hypertext Transfer Protocol (HTTP) data packets from the communication data.

[0032] The second extraction module is used to extract data encryption algorithms and certificate signing algorithms from the transport layer security protocol data packets, and to extract plaintext links from the hypertext transfer protocol data packets.

[0033] A security detection module is used to determine the security of the communication data based on the data encryption algorithm, the certificate signing algorithm, and the plaintext link.

[0034] Thirdly, the present invention provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the secure detection method for vehicle network communication data described in the first aspect above.

[0035] Fourthly, the present invention provides a storage medium storing a computer program that, when executed by a processor, implements the security detection method for vehicle network communication data described in the first aspect above.

[0036] Compared to related technologies, the security detection method, apparatus, device, and storage medium for vehicle-to-everything (V2X) communication data provided in this invention, after acquiring the communication data between the vehicle under test and the server, first automatically extracts Transport Layer Security (TLS) data packets and Hypertext Transfer Protocol (HTTP) data packets from the communication data. Then, it automatically extracts data encryption algorithms, certificate signing algorithms, and plaintext links from these data packets. Based on the security of the data encryption algorithms, certificate signing algorithms, and plaintext links, the security of the communication data is determined. Compared to existing technologies that simply check the TLS protocol version to determine the security of communication data, the security detection method in this invention extracts the data encryption algorithms, certificate signing algorithms, and plaintext links from the communication data more deeply and determines the security of the communication data based on the security of these three elements. This results in a higher accuracy in security detection.

[0037] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0038] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0039] Figure 1 This is a hardware structure block diagram of the terminal that implements the vehicle network communication data security detection method of the present invention.

[0040] Figure 2 This is a flowchart of a method for security detection of vehicle network communication data in an embodiment of the present invention.

[0041] Figure 3 This is a flowchart of a method for security detection of vehicle network communication data in a specific embodiment of the present invention.

[0042] Figure 4 This is a structural block diagram of a vehicle network communication data security detection device according to an embodiment of the present invention. Detailed Implementation

[0043] To better understand the purpose, technical solution, and advantages of this application, the application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0044] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning as understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these,” used in this application, do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to such processes, methods, products, or devices. The terms “connected,” “linked,” and “coupled,” used in this application, are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. The term “multiple” used in this application refers to two or more. The "and / or" operator describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: A alone, A and B simultaneously, and B alone. Typically, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," and "third," etc., used in this application are merely for distinguishing similar objects and do not represent a specific ordering of the objects.

[0045] The method embodiments provided in this example can be executed on a terminal, computer, or similar computing device. For example, it can run on a terminal. Figure 1 This is a hardware structure block diagram of the terminal executing the vehicle network communication data security detection method of the present invention. For example... Figure 1 As shown, a terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 and a memory 104 for storing data are also included. The processor 102 may be, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA). The terminal may also include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that… Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the terminal described above. For example, the terminal may also include components that are larger than... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown are illustrated.

[0046] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the vehicle network communication data security detection method in this invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0047] The transmission device 106 is used to receive or send data via a network. This network includes a wireless network provided by the terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 can be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0048] This invention provides a method for secure detection of vehicle network communication data. Figure 2 This is a flowchart of a method for secure detection of vehicle network communication data in an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0049] Step S210: Obtain communication data between the vehicle under test and the server.

[0050] In this step, the security testing equipment first acquires the communication data between the vehicle under test and the server. This can be done by real-time monitoring or exporting traffic packets. Furthermore, the vehicle-to-everything (V2X) system includes a vehicle platform, a vehicle app, a server, and the vehicle itself. Both the vehicle app and the vehicle platform can send vehicle control commands to the server, which then forwards these commands to the corresponding vehicles. In this step, the security testing equipment acquires the communication data between the vehicle and the server to detect any security issues in their communication.

[0051] Step S220: Extract Transport Layer Security Protocol (TLS) data packets and Hypertext Transfer Protocol (HTTP) data packets from the communication data.

[0052] In this step, after acquiring the communication data between the vehicle under test and the server, the security testing equipment extracts Transport Layer Security (TLS) data packets and Hypertext Transfer Protocol (HTTP) data packets from the communication data. Specifically, the security testing equipment obtains the server IP and the IP of the vehicle under test from the communication data, and extracts TLS protocol data packets and HTTP protocol data packets.

[0053] Step S230: Extract the data encryption algorithm and certificate signing algorithm from the Transport Layer Security Protocol (TLS) data packet, and extract the plaintext link from the Hypertext Transfer Protocol (HTTP) data packet.

[0054] In this step, after extracting the Transport Layer Security (TLS) data packets, the security detection device further extracts the data encryption algorithm and certificate signing algorithm used for the communication data from the data packets. Similarly, after extracting the Hypertext Transfer Protocol (HTTP) data packets, the security detection device further extracts the plaintext link from the data packets.

[0055] Step S240: Determine the security of the communication data based on the data encryption algorithm, certificate signing algorithm, and plaintext link.

[0056] In this step, after extracting the data encryption algorithm, certificate signing algorithm, and plaintext link, the security testing equipment will assess the security of each algorithm and the plaintext link. Then, by combining the security status of these three factors, the security of the communication data between the vehicle under test and the server can be determined. For example, if any one of the data encryption algorithm, certificate signing algorithm, or plaintext link has a security problem, the vehicle network communication data is deemed to have a security issue. Alternatively, the security level of the communication data between the vehicle under test and the server can be determined based on the security status of these three factors.

[0057] Through the above steps, after acquiring the communication data between the vehicle under test and the server, the security detection equipment first automatically extracts Transport Layer Security (TLS) data packets and Hypertext Transfer Protocol (HTTP) data packets from the communication data. Then, it automatically extracts data encryption algorithms, certificate signing algorithms, and plaintext links from these data packets. Based on the security of these three elements, the security of the communication data is determined. Compared to existing technologies that simply check the TLS protocol version to determine the security of communication data, the security detection method in this invention extracts the data encryption algorithms, certificate signing algorithms, and plaintext links from the communication data more deeply and determines the security of the communication data based on the security of these three elements. This results in a higher level of accuracy in security detection.

[0058] In some embodiments, in step S230, extracting the data encryption algorithm and certificate signing algorithm from the transport layer security protocol data packet includes:

[0059] Step S231: Extract the data encryption algorithm from the transport layer security protocol data packet according to the field identifier of the data encryption algorithm.

[0060] Step S232: Extract the certificate signing algorithm from the transport layer security protocol data packet according to the field identifier of the certificate signing algorithm.

[0061] Specifically, this embodiment provides a method for extracting data encryption algorithms and certificate signing algorithms from transport layer security (TLS) protocol data packets. Since both data encryption algorithms and certificate signing algorithms have their own field identifiers in the protocol data packets, these field identifiers can be used to identify and extract the corresponding algorithms. For example, the Cipher Suite field identifier can be parsed and extracted from the TLS protocol data packets to extract the corresponding data encryption algorithm. Similarly, the Algorithm Identifier field identifier can be parsed and extracted from the TLS protocol data packets to extract the corresponding certificate signing algorithm. Furthermore, security detection devices can automatically identify and extract the corresponding algorithms using these field identifiers.

[0062] In some embodiments, in step S230, extracting the plaintext link from the Hypertext Transfer Protocol data packet includes:

[0063] Step S233: Obtain the parameter type, parameter content, and website address from the Hypertext Transfer Protocol data packet, and determine the plaintext link based on the parameter type, parameter content, and website address.

[0064] Specifically, this embodiment provides a method for extracting plaintext links from Hypertext Transfer Protocol (HTTP) data packets. For example, the security detection device determines the website address by indexing the Host parameter in the HTTP data packet, extracts the Expert Info parameter from the data packet to extract the parameter type and content, and finally concatenates the website address, parameter type, and parameter content to obtain the plaintext link. The Expert Info parameter specifically includes either POST or GET parameters.

[0065] In some embodiments, step S240, determining the security of the communication data based on the data encryption algorithm, certificate signing algorithm, and plaintext link, includes:

[0066] Step S241: Match the field features of the data encryption algorithm with the preset first database, and determine the security of the data encryption algorithm based on the matching results.

[0067] Step S242: Match the field features of the certificate signing algorithm with the preset second database, and determine the security of the certificate signing algorithm based on the matching results.

[0068] Step S243: Determine the security of the communication data based on the security of the data encryption algorithm, the security of the certificate signing algorithm, and the plaintext link.

[0069] Specifically, this embodiment provides a specific means to determine the security of communication data. The security monitoring device first needs to detect the security of the data encryption algorithm, the certificate signing algorithm, and the plaintext link, respectively.

[0070] Furthermore, the security detection of data encryption algorithms refers to the detection of the security of symmetric encryption key exchange algorithms, asymmetric key algorithms (public / private key algorithms), splitting operations, symmetric encryption algorithms, and hash algorithms in the data encryption process. After extracting the data encryption algorithm based on the identifier field, the security detection device identifies the field features in the data encryption algorithm that can reflect key information, such as encryption method and key length, and matches the field features of the key information with a preset first database. The first database contains field features of different data encryption algorithms and the corresponding security levels for each field feature. Then, the security of the data encryption algorithm can be determined based on the field matching results. For example, the data encryption algorithm extracted through the Cipher Suite field identifier in the protocol data packet is: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. Then, key information fields such as encryption method and key length are extracted from the field information of the above data encryption algorithm, and the corresponding key information fields are matched with the first database to determine whether the encryption method and key of the data encryption algorithm are easily cracked, thus ultimately determining the security of the data encryption algorithm.

[0071] Simultaneously, after extracting the certificate signing algorithm from the identifier field, the security detection equipment identifies the field features within the certificate signing algorithm that reflect key information, including the two-way authentication mechanism and other critical information. It then matches these key information field features with a pre-defined second database. This second database contains field features of different certificate signing algorithms and the corresponding security levels for each feature. For example, the certificate signing algorithm extracted from the Algorithm Identifier field in the protocol data packet is SHA256_With_RSA_Encryption. Then, key information fields, such as the two-way authentication mechanism and other critical information, are extracted from the certificate signing algorithm's field information. These key information fields are then matched with the second database to determine whether the two-way authentication mechanism of the certificate signing algorithm securely acquires other mechanisms, ultimately determining the security of the certificate signing algorithm.

[0072] Furthermore, after obtaining a plaintext link, the security detection equipment will display the content of the plaintext link so that humans can view and analyze the content to determine whether the plaintext link contains sensitive information.

[0073] In some embodiments, the security detection method for vehicle-to-everything (V2X) communication data further includes:

[0074] Step S250: Obtain the data streams flowing into and out of the vehicle under test.

[0075] Step S260: Identify a target data stream containing Uniform Resource Locator (URI) characteristics from the data stream, and identify a malicious data stream containing attack characteristics from the target data stream.

[0076] Step S270: Determine the malicious host address based on the malicious data stream.

[0077] In this embodiment, the security detection device, in addition to detecting the communication data between the vehicle and the server, also detects all data streams flowing into and out of the vehicle under test, and determines whether an attack exists based on the data streams. In related existing technologies, automotive devices need to monitor all traffic flowing through them, compare it with traffic characteristics in a signature database, and process related traffic simultaneously, thus requiring very large resources. Because IDS resources are scarce, they generally tend to use resources to handle DoS-type attacks (this type of attack logic is simple), so when the vehicle networking device exposes resource deficiencies, protection loopholes and functional limitations may occur. Currently, effective attack methods to circumvent IPS / IDS detection within the vehicle networking system include: session segmentation and fragmentation, concealing traces, placing backdoors, and vulnerability exploitation. The security detection steps in this embodiment address the problem of protection loopholes in IDS / IPS detection caused by the scarcity of automotive device resources by using traffic packet capture and Wireshark traffic monitoring to discover attack packets containing remote control commands.

[0078] Specifically, the security detection equipment first identifies the IP address of the vehicle under test from the communication data, and then automatically intercepts and exports all data streams flowing to the vehicle under test. These data streams include TCP protocol data streams and HTTP protocol data streams. Since attackers typically use URLs within the data streams to point to themselves and upload a randomly named malicious file (bypassing blacklist filtering) to the vehicle under test, in this embodiment, the security detection equipment extracts data streams containing Uniform Resource Locators (URLs) as target data streams. These target data streams are potentially vulnerable to security breaches. Accordingly, further analysis of the target data streams is needed to determine whether they contain attack characteristics, including attack commands and tools. Target data streams containing attack characteristics are identified as malicious data streams, and the malicious host corresponding to these malicious data streams is the attacking host. Finally, the malicious host address is extracted from the malicious data stream. It should be noted that the analysis and detection of target data streams can be performed manually or automatically by a computer.

[0079] It should be noted that attackers typically use shell traffic to launch attacks, which involves sending shell connections via the TCP protocol. Therefore, the data stream detected in this embodiment is generally shell traffic data.

[0080] Furthermore, in some embodiments, in step S260, determining a malicious data stream containing attack characteristics from the target data stream includes:

[0081] Step S261: For the target data stream flowing into the vehicle under test, detect the attack commands in the target data stream and identify the target data stream with attack commands as a malicious data stream.

[0082] Step S262: For the target data stream of the vehicle under test, detect the attack tool field in the target data stream, and identify the target data stream with the attack tool field as a malicious data stream.

[0083] In this embodiment, different detection methods are used for data streams flowing into or out of the vehicle under test. For data streams flowing from an external host to the vehicle (forward shell data streams), the main focus is on detecting whether the data stream contains attack commands. For example, the security detection device automatically detects the commands and files called, primarily focusing on common commands such as whoami, ls, cp, cd, and commonly used directories like / etc / , / data / , and / tmp / , and examines the command return values ​​based on the detected attack commands. Target data streams containing attack commands are identified as malicious data streams. For data streams flowing from the vehicle to an external host (reverse shell data streams), the main focus is on detecting whether the data stream contains attack tools. For example, the security detection device detects key field information of attack tools such as Metasploit, nc, and CS. Target data streams containing attack tools are identified as malicious data streams. Furthermore, to prevent encrypted data transmission, an ssl_key.log file is recorded simultaneously, and the key information within is extracted to decrypt the data stream, preventing encrypted data from bypassing the IDS.

[0084] In some embodiments, the security detection method for vehicle-to-everything (V2X) communication data further includes:

[0085] Step S280: The malicious host address is fed back to the vehicle under test, and a blacklist mechanism is established in the firewall to block attacks from the malicious host address.

[0086] In this embodiment, after obtaining the malicious host address, the security detection device will also report the malicious host address to the corresponding vehicle and add a blacklist mechanism to the firewall (which requires granting the vehicle the corresponding root privileges) to block reverse shell attacks or forward shell attacks.

[0087] The following describes the security detection method for vehicle network communication data in this application through a specific embodiment.

[0088] Figure 3 This is a flowchart of a method for secure detection of vehicle network communication data in a specific embodiment of the present invention. (Refer to...) Figure 3 The process includes:

[0089] Step S310: Obtain communication data between the server and the vehicle by real-time monitoring or exporting traffic packets.

[0090] Step S320: Analyze the captured communication data and extract the data encryption algorithm.

[0091] Specifically, the process begins by obtaining the server IP and vehicle IP from the communication data and extracting TLS packets. Then, the Cipher Suite field identifier is parsed and extracted from the TLS packets, from which the corresponding data encryption algorithm is derived. Finally, the extracted data encryption algorithm is analyzed. Furthermore, the security testing equipment can automatically detect the security of symmetric encryption key exchange algorithms, asymmetric key algorithms (public / private key algorithms), splitting operations, symmetric encryption algorithms, and hash algorithms during the data encryption process.

[0092] For example, the data encryption algorithm extracted by the Cipher Suite field in the protocol data packet is identified as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. Then, key information fields such as encryption method and key length are extracted from the field information of the above data encryption algorithm, and the key information fields are matched with the database to determine the security of the data encryption algorithm.

[0093] Step S330: Analyze the captured communication data and extract the certificate signature algorithm.

[0094] Specifically, the process begins by obtaining the server IP and vehicle IP from the communication data and extracting the TLS data packets. Then, the Algorithm Identifier field is parsed and extracted from the TLS data packets to obtain the corresponding certificate signing algorithm. Finally, the extracted certificate signing algorithm is analyzed. Consequently, the security testing equipment can automatically test the security of the certificate signing algorithm and the two-way authentication.

[0095] For example, the certificate signing algorithm extracted is identified by the Algorithm Identifier field in the protocol data packet as SHA256_With_RSA_Encryption. Then, key information fields such as two-way authentication mechanism and other key information are extracted from the field information of the above certificate signing algorithm, and the key information fields are matched with the database to determine the security of the certificate signing algorithm.

[0096] Step S340: Analyze and extract plaintext links.

[0097] Specifically, the server IP and vehicle IP are first obtained from the communication data, and the HTTP data packets are extracted. Then, the information of the POST or GET parameters in the data packets is intercepted and concatenated with the host's parameter information to extract the plaintext link of the data packets.

[0098] For example, the website address is first determined by the Host parameter in the index data packet, and the Expert Info parameter (POST or GET parameter) in the data packet is extracted to extract the data packet parameter type and parameter content. Finally, the data is concatenated to obtain the plaintext link.

[0099] Step S350: Forward shell and reverse shell detection and defense interception.

[0100] Specifically, this step mainly involves identifying remote control commands, detecting forward shells (from the attacker connecting to the vehicle's infotainment system) controlling vehicle components, and extracting target IPs through reverse shells (from the vehicle's infotainment system back to the attacker's end), and automatically filtering them using a blacklist.

[0101] Attackers typically use shell traffic to launch attacks, which involves sending shell connections via TCP (Transmission Control Protocol).

[0102] The security detection equipment first identifies the vehicle's IP address from the communication data, then automatically intercepts and exports all TCP and HTTP streams flowing to the device. Typically, attackers will use URLs within the TCP data to point to themselves and upload a randomly named malicious file (bypassing blacklist filtering) to the target vehicle's infotainment system. Therefore, the security detection equipment uses URL characteristics to identify streams storing relevant features within a large volume of TCP streams and performs IP extraction to collect the addresses of potentially vulnerable hosts.

[0103] Next, the TCP stream data is examined, which can be done manually or by computer. Manual inspection involves manually viewing the TCP stream using Hex, examining the attacker's shell communications to manually determine the data content. This method is suitable for engineers familiar with attack and defense principles. Computer-based detection involves automated detection of commands and files called by the security detection device. It primarily targets common commands such as whoami, ls, cp, cd, and frequently used directories like / etc / , / data / , and / tmp / , performing automated analysis and examining the command return values ​​based on the detected attack commands. The obtained malicious IPs are then fed back to the vehicle system sample, and a firewall blacklist mechanism (requiring root privileges for the detection script in this embodiment) is added to block forward shell attacks.

[0104] For the detection and interception of reverse shell attacks, the principle of a reverse shell attack is that the attacking end opens a listening service, causing the victim to actively connect to the system. The main advantage of this attack is that the firewall inside the vehicle's infotainment system generally filters incoming data but rarely blocks outgoing data, making it an effective means of circumventing firewalls and IDS (Intrusion Detection System). Therefore, when performing reverse shell detection, the security detection device mainly checks the attack tool fields in the TCP stream, such as key field information of attack tools like Metasploit, nc, and CS. Simultaneously, to prevent encrypted transmission, it records the ssl_key.log file, extracts the key information from it, and decrypts the data stream to prevent encrypted data from being bypassed by IDS. Finally, the obtained malicious IP is fed back to the vehicle's infotainment system sample, and a blacklist mechanism is added to the firewall (requiring root privileges for the detection script in this embodiment) to block reverse shell attacks.

[0105] This embodiment also provides a security detection device for vehicle network communication data. This device is used to implement the above embodiments and preferred embodiments, and details already described will not be repeated. The terms "module," "unit," "subunit," etc., used below refer to combinations of software and / or hardware that implement a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0106] Figure 4 This is a structural block diagram of a vehicle network communication data security detection device according to an embodiment of the present invention, such as... Figure 4 As shown, the device includes:

[0107] Data acquisition module 410 is used to acquire communication data between the vehicle under test and the server;

[0108] The first extraction module 420 is used to extract transport layer security protocol data packets and hypertext transfer protocol data packets from communication data;

[0109] The second extraction module 430 is used to extract data encryption algorithms and certificate signing algorithms from transport layer security protocol data packets, and to extract plaintext links from hypertext transfer protocol data packets.

[0110] The security detection module 440 is used to determine the security of communication data based on data encryption algorithms, certificate signing algorithms, and plaintext links.

[0111] It should be noted that the above modules can be functional modules or program modules, and can be implemented through software or hardware. For modules implemented through hardware, the above modules can reside in the same processor; or the above modules can be located in different processors in any combination.

[0112] This embodiment also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0113] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated in this embodiment.

[0114] Furthermore, in conjunction with the vehicle-to-everything (V2X) communication data security detection method provided in the above embodiments, this embodiment can also provide a storage medium for implementation. This storage medium stores a computer program; when executed by a processor, the computer program implements any of the V2X communication data security detection methods described in the above embodiments.

[0115] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0116] It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. All other embodiments derived by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0117] Obviously, the accompanying drawings are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar situations based on these drawings without any creative effort. Furthermore, it is understood that although the work done in this development process may be complex and lengthy, for those skilled in the art, certain design, manufacturing, or production modifications made based on the technical content disclosed in this application are merely conventional technical means and should not be considered as insufficient disclosure of this application.

[0118] The term "embodiment" in this application refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply that it is mutually exclusive with or independent of other embodiments. It will be clearly or implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0119] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of patent protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A method for secure detection of vehicle-to-everything (V2X) communication data, characterized in that, The method includes: Acquire communication data between the vehicle under test and the server; Extract Transport Layer Security (TLS) data packets and Hypertext Transfer Protocol (HTTP) data packets from the communication data; Extract data encryption algorithms and certificate signing algorithms from the Transport Layer Security Protocol (TLS) data packets, and extract plaintext links from the Hypertext Transfer Protocol (HTTP) data packets; The security of the communication data is determined based on the data encryption algorithm, the certificate signing algorithm, and the plaintext link. Acquire the data streams flowing into and out of the vehicle under test; Determining a target data stream containing Uniform Resource Locator (URL) characteristics from the data stream, and determining a malicious data stream containing attack characteristics from the target data stream, including: For the target data stream flowing into the vehicle under test, the attack commands in the target data stream are detected, and the target data stream containing the attack commands is identified as a malicious data stream. For the target data stream flowing out of the vehicle under test, the attack tool field in the target data stream is detected, and the target data stream containing the attack tool field is identified as a malicious data stream. The malicious host address is determined based on the malicious data stream.

2. The method for secure detection of vehicle network communication data according to claim 1, characterized in that, The data encryption algorithm and certificate signing algorithm extracted from the transport layer security protocol data packet include: The data encryption algorithm is extracted from the transport layer security protocol data packet based on the field identifier of the data encryption algorithm. The certificate signing algorithm is extracted from the transport layer security protocol data packet based on the field identifier of the certificate signing algorithm.

3. The security detection method for vehicle network communication data according to claim 1, characterized in that, The step of extracting the plaintext link from the Hypertext Transfer Protocol data packet includes: The parameter type, parameter content, and website address are obtained from the Hypertext Transfer Protocol data packet, and the plaintext link is determined based on the parameter type, parameter content, and website address.

4. The method for secure detection of vehicle network communication data according to claim 1, characterized in that, Determining the security of the communication data based on the data encryption algorithm, the certificate signing algorithm, and the plaintext link includes: The field features of the data encryption algorithm are matched with a preset first database, and the security of the data encryption algorithm is determined based on the matching results. The field features of the certificate signing algorithm are matched with a preset second database, and the security of the certificate signing algorithm is determined based on the matching results. The security of the communication data is determined based on the security of the data encryption algorithm, the security of the certificate signing algorithm, and the plaintext link.

5. The method for secure detection of vehicle network communication data according to claim 1, characterized in that, The method further includes: The malicious host address is fed back to the vehicle under test, and a blacklist mechanism is established in the firewall to block attacks from the malicious host address.

6. A security detection device for vehicle-to-everything (V2X) communication data, characterized in that, The device includes: The data acquisition module is used to acquire communication data between the vehicle under test and the server. The first extraction module is used to extract Transport Layer Security Protocol (TLS) data packets and Hypertext Transfer Protocol (HTTP) data packets from the communication data. The second extraction module is used to extract data encryption algorithms and certificate signing algorithms from the transport layer security protocol data packets, and to extract plaintext links from the hypertext transfer protocol data packets. A security detection module is used to determine the security of the communication data based on the data encryption algorithm, the certificate signing algorithm, and the plaintext link. The security detection device is used to acquire data streams flowing into and out of the vehicle under test; determine target data streams containing Uniform Resource Locator (URL) characteristics from the data streams, and determine malicious data streams containing attack characteristics from the target data streams, including: for target data streams flowing into the vehicle under test, detecting attack commands in the target data streams, and determining target data streams containing the attack commands as malicious data streams; for target data streams flowing out of the vehicle under test, detecting attack tool fields in the target data streams, and determining target data streams containing the attack tool fields as malicious data streams. The security detection device is also used to determine the address of a malicious host based on the malicious data stream.

7. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the security detection method for vehicle network communication data as described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the method for secure detection of vehicle network communication data as described in any one of claims 1 to 5.

Images