Security Status Scoring System and Method for Vehicle Internet of Things Security Situation

Abstract

The present invention discloses a security status scoring system for the security situation of the Internet of Vehicles. The threat warning server at the vehicle end of the Internet of Vehicles labels the corresponding vehicle-end security label levels for the threat warning information generated at the vehicle end of the Internet of Vehicles according to the threat levels; the threat warning server in the cloud of the Internet of Vehicles labels the corresponding cloud security label levels for the threat warning information generated in the cloud of the Internet of Vehicles according to the threat levels; the security warning score calculation server of the Internet of Vehicles performs score operations on the labeled vehicle-end security label levels and cloud security label levels respectively, and multiplies the score corresponding to the vehicle-end security label level by the vehicle-end score weight + the score corresponding to the cloud security label level by the cloud score weight to obtain the overall security situation score of the Internet of Vehicles.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Vehicles, and particularly to a security status scoring system and method for the security situation of the Internet of Vehicles. Background Art

[0002] The existing security situation awareness of the Internet of Vehicles shows the security situation of the Internet of Vehicles through a series of display means (such as the number of alarms, the number of security events, the list of alarms, etc.), or shows the security situation of the Internet of Vehicles through the number of high-risk and medium-risk.

[0003] In the above methods, the data of the vehicle terminal and the data of the cloud in the Internet of Vehicles are usually displayed separately, and it is impossible to effectively integrate and display the security status of the enterprise's Internet of Vehicles, and it is impossible to clearly guide the current security situation of the enterprise's Internet of Vehicles. Summary of the Invention

[0004] The purpose of the present invention is to provide a security situation scoring system and method for the security situation of the Internet of Vehicles. The present invention integrates and displays the data of the vehicle terminal and the data of the cloud in the Internet of Vehicles, and realizes a clear and intuitive display of the security situation of the Internet of Vehicles.

[0005] To achieve this purpose, the security situation scoring system for the security situation of the Internet of Vehicles designed by the present invention includes a vehicle terminal threat alarm server for the Internet of Vehicles, a cloud threat alarm server for the Internet of Vehicles, and a security alarm score calculation server for the Internet of Vehicles;

[0006] The vehicle terminal threat alarm server for the Internet of Vehicles is used to label the corresponding vehicle terminal security label level according to the threat level for the threat alarm information generated by the vehicle terminal of the Internet of Vehicles;

[0007] The cloud threat alarm server for the Internet of Vehicles is used to label the corresponding cloud security label level according to the threat level for the threat alarm information generated by the cloud of the Internet of Vehicles;

[0008] The security alarm score calculation server for the Internet of Vehicles is used to perform score operations on the labeled vehicle terminal security label level and cloud security label level respectively, and multiply the score corresponding to the vehicle terminal security label level by the vehicle terminal score weight + the score corresponding to the cloud security label level by the cloud score weight to obtain the overall security situation score of the Internet of Vehicles.

[0009] Advantages of the Present Invention

[0010] Through the technical solution of the present invention, the security status of the enterprise's Internet of Vehicles can be displayed by a percentage score and corresponding colors, and the data of the vehicle terminal and the data of the cloud in the Internet of Vehicles are integrated and displayed, realizing a clear and intuitive display of the security situation of the Internet of Vehicles. Brief Description of the Drawings

[0011] Figure 1This is a schematic structural diagram of the present invention. Detailed implementation manners

[0012] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments:

[0013] As Figure 1 shown, a security status scoring system for the security situation of the vehicle networking includes a vehicle networking vehicle - end threat warning server, a vehicle networking cloud - end threat warning server, and a vehicle networking security warning score calculation server;

[0014] The vehicle networking vehicle - end threat warning server is used to label the corresponding vehicle - end security label level according to the threat level for the threat warning information generated by the vehicle networking vehicle - end.

[0015] The vehicle networking cloud - end threat warning server is used to label the corresponding cloud - end security label level according to the threat level for the threat warning information generated by the vehicle networking cloud - end.

[0016] The vehicle networking security warning score calculation server is used to perform score operations on the labeled vehicle - end security label level and cloud - end security label level respectively, and multiply the score corresponding to the vehicle - end security label level by the vehicle - end score weight + multiply the score corresponding to the cloud - end security label level by the cloud - end score weight to obtain the overall security situation score of the vehicle networking.

[0017] The present invention uses simple and clear numbers to uniformly display different numbers of warnings for different threat levels, and uses numbers in the range of 0 - 100 to represent the degree of security. The smaller the number, the lower the security level, and the larger the number, the higher the security level.

[0018] In the above - mentioned technical solution, the threat warning information of the vehicle networking vehicle - end is generated by the log system or security log component of the vehicle networking vehicle - end itself. The vehicle - end components are developed based on Android, AUTOSAR (Automotive Open System Architecture), and Unix - like systems, and the vehicle - end components already have log components; the threat warning information of the vehicle networking cloud - end is generated by the log system or security log component of the vehicle networking cloud - end itself. The cloud - end operating systems are centos, ubuntu, and windows, and the cloud - end operating systems already have log components.

[0019] In the above technical solution, the vehicle - end security label levels corresponding to each threat warning message generated by the vehicle - end of the Internet of Vehicles are as follows: when the threat warning message of the vehicle - end of the Internet of Vehicles is normal service data, the vehicle - end security label level is level 0; when the threat warning message of the vehicle - end of the Internet of Vehicles is other types of warnings not listed, the vehicle - end security label level is level 1; when the threat warning message of the vehicle - end of the Internet of Vehicles is an ICMP (Internet Control Message Protocol) type warning, the vehicle - end security label level is level 2; when the threat warning message of the vehicle - end of the Internet of Vehicles is a port - scanning type warning, the vehicle - end security label level is level 3; when the threat warning message of the vehicle - end of the Internet of Vehicles is an account - login type warning, the vehicle - end security label level is level 4; when the threat warning message of the vehicle - end of the Internet of Vehicles is an account - brute - force type warning, the vehicle - end security label level is level 5; when the threat warning message of the vehicle - end of the Internet of Vehicles is an abnormal CAN (Controller Area Network) bus message type warning, the vehicle - end security label level is level 6; when the threat warning message of the vehicle - end of the Internet of Vehicles is an abnormal traffic - consumption type warning, the vehicle - end security label level is level 7; when the threat warning message of the vehicle - end of the Internet of Vehicles is a malicious - application type warning, the vehicle - end security label level is level 8; when the threat warning message of the vehicle - end of the Internet of Vehicles is a Shell (in computer science, Shell, also known as the shell (to distinguish it from the kernel), refers to the software that "provides an operation interface" for users (command interpreter)) operation type warning, the vehicle - end security label level is level 9; when the threat warning message of the vehicle - end of the Internet of Vehicles is a system - control type warning, the vehicle - end security label level is level 10. Level 0 is the lowest threat level, and level 10 is the highest threat level. Relative to a successfully invaded / control - successful system, that is, levels 0 - 10 represent the degree of successful invasion or control of the cloud / vehicle - end. Level 0 represents the warning with the lowest threat, and level 10 is the warning with the highest threat level. The warning types corresponding to each level will be elaborated in the following description.

[0020] In the above technical solution, the cloud security label levels corresponding to each threat warning message generated by the vehicle networking cloud are as follows: when the threat warning message of the vehicle networking cloud is normal service data, the cloud security label level is level 0; when the threat warning message of the vehicle networking cloud is other types of warnings not listed, the cloud security label level is level 1; when the threat warning message of the vehicle networking cloud is an ICMP type warning, the cloud security label level is level 2; when the threat warning message of the vehicle networking cloud is a port scanning type warning, the cloud security label level is level 3; when the threat warning message of the vehicle networking cloud is an account login type warning, the cloud security label level is level 4; when the threat warning message of the vehicle networking cloud is an account brute force type warning, the cloud security label level is level 5; when the threat warning message of the vehicle networking cloud is a cross-site scripting attack warning, the cloud security label level is level 6; when the threat warning message of the vehicle networking cloud is an SQL (Structured Query Language) injection type warning, the cloud security label level is level 7; when the threat warning message of the vehicle networking cloud is an advanced threat attack type warning, the cloud security label level is level 8; when the threat warning message of the vehicle networking cloud is a SHELL operation type warning, the cloud security label level is level 9; when the threat warning message of the vehicle networking cloud is a system control type warning, the cloud security label level is level 10.

[0021] In the above technical solution, the method for the vehicle networking security warning score calculation server to perform score calculation on the marked vehicle terminal security label level is as follows:

[0022] When there is only one level of vehicle terminal security label in the marked vehicle terminal security label levels, it is the initial stage (the initial stage only appears when the system is just deployed, and there is a single type of warning). The score corresponding to the vehicle terminal security label level in the initial stage is [100 - ((11 - N) * 10 + (-1) * X1 * 10)], where N is the numerical value of the vehicle terminal security label level, and X1 is the number of occurrences of the warning of this vehicle terminal security label level in the initial stage. For example, when only a warning of level 10 appears in the initial stage, the score corresponding to the vehicle terminal security label level in the initial stage is [100 - ((11 - 10) * 10 + (-1) * X1 * 10)]. Through the above calculation, different numbers are assigned to the warnings of each level (0 to 10 levels). For example, the number calculated after the warning of level 10, which is serious in terms of warning degree (relative to successful intrusion / control of the system), is small, and the number calculated after the warning of level 0, which is not serious in terms of warning degree, is large.

[0023] In the above technical solution, the method for the vehicle networking security warning score calculation server to perform score calculation on the marked cloud security label level is as follows:

[0024] When there is exactly one level of cloud security label among the labeled cloud security label levels, it is the initial stage. The score corresponding to the cloud security label level in the initial stage is [100 - ((11 - M) * 10 + (-1) * X2 * 10)], where M is the numerical value of the cloud security label level, and X2 is the number of alarms for this cloud security label level that occur in the initial stage.

[0025] In the above technical solution, the method by which the vehicle networking security warning score calculation server performs score operations on the labeled vehicle - end security label levels is as follows:

[0026] When there are any two or more levels of vehicle - end security labels among the labeled vehicle - end security label levels, it is the non - initial stage. The score corresponding to the vehicle - end security label level in the non - initial stage is [100 - (z0 + z1 + z2 + z3 + z4 + z5 + z6 + z7 + z8 + z9 + z10)];

[0027]

[0028] For example:

[0029]

[0030] Among them, 0 ≤ N ≤ 10, and zN represents one of z0 to z10;

[0031]

[0032] For example:

[0033]

[0034] Among them, 0 ≤ N ≤ 10, yN represents one of y0 to y10, and xN is the number of alarms for this vehicle - end security label level that occur in the non - initial stage, 0 ≤ xN;

[0035] The value range of the operation result of the score corresponding to the vehicle - end security label level in the non - initial stage is an integer in the range of 0 to 100 (i.e., the result is forced to be an integer). Any number less than 0 is taken as 0, and any number greater than 100 is taken as 100.

[0036] In the above technical solution, the method by which the vehicle networking security warning score calculation server performs score operations on the labeled cloud security label levels is as follows:

[0037] When there are any two or more levels of cloud security labels among the labeled cloud security label levels, it is the non - initial stage. The score corresponding to the cloud security label level in the non - initial stage is [100 - (Z0 + Z1 + Z2 + Z3 + Z4 + Z5 + Z6 + Z7 + Z8 + Z9 + Z10)];

[0038]

[0039] Among them, 0 ≤ M ≤ 10, and ZM represents one of Z0 to Z10;

[0040]

[0041] Among them, 0 ≤ M ≤ 10, YM represents one of Y0 to Y10, and XM is the number of occurrences of the cloud security label level alarm in the non-initial stage, 0 ≤ XM;

[0042] The value range of the operation result of the score corresponding to the cloud security label level in the non-initial stage is an integer in the range of 0 to 100. Any number less than 0 is taken as 0, and any number greater than 100 is taken as 100.

[0043] In the above technical solution, the specific method for the vehicle networking security warning score calculation server to multiply the score corresponding to the vehicle-end security label level by the vehicle-end score weight + the score corresponding to the cloud security label level by the cloud score weight to obtain the overall vehicle networking security situation score is as follows:

[0044] When the vehicle networking vehicle-end is in the primary stage and the vehicle networking cloud is in the primary stage, the overall vehicle networking security situation score is the score corresponding to the vehicle-end security label level in the initial stage multiplied by the vehicle-end score weight + the score corresponding to the cloud security label level in the initial stage multiplied by the cloud score weight;

[0045] When the vehicle networking vehicle-end is in the non-primary stage and the vehicle networking cloud is in the non-primary stage, the overall vehicle networking security situation score is the score corresponding to the vehicle-end security label level in the non-initial stage multiplied by the vehicle-end score weight + the score corresponding to the cloud security label level in the non-initial stage multiplied by the cloud score weight;

[0046] When the vehicle networking vehicle-end is in the primary stage and the vehicle networking cloud is in the non-primary stage, the overall vehicle networking security situation score is the score corresponding to the vehicle-end security label level in the initial stage multiplied by the vehicle-end score weight + the score corresponding to the cloud security label level in the non-initial stage multiplied by the cloud score weight;

[0047] When the vehicle networking vehicle-end is in the non-primary stage and the vehicle networking cloud is in the primary stage, the overall vehicle networking security situation score is the score corresponding to the vehicle-end security label level in the non-initial stage multiplied by the vehicle-end score weight + the score corresponding to the cloud security label level in the initial stage multiplied by the cloud score weight. The effect of the above calculation takes into account both the warnings of vehicle-end threats and the warnings of cloud threats, and there will be no incomplete situation of ignoring the warnings of either the vehicle-end or the cloud.

[0048] In this embodiment, the above various weights are all taken as 50%.

[0049] The present invention further includes a vehicle networking security warning score display server, which is responsible for directly displaying the total score of the final result of the vehicle networking security warning score calculation server, and at the same time displaying the color corresponding to the total score as the security conclusion. The color corresponding to the total score is specifically as follows:

[0050] Total safety score Total safety score value Corresponding color Safety conclusion level1 0-9 Dark red Extremely dangerous level2 10-19 Dark red Extremely dangerous level3 20-29 Red Dangerous level4 30-39 Red Dangerous level5 40-49 Red Dangerous level6 50-59 Yellow Risk level7 60-69 Yellow Risk level8 70-79 Yellow Risk level9 80-89 Green Safe level10 90-99 Green Safe level11 100 Green Safe

[0051] In this embodiment, all servers are developed in JAVA language and deployed using the CentOS+MYSQL+Tomcat solution.

[0052] A security status scoring method based on the above system, which includes the following steps:

[0053] Step 1: Mark the corresponding vehicle terminal security label level for the threat warning information generated by the vehicle terminal of the vehicle networking according to the threat level;

[0054] Step 2: Mark the corresponding cloud security label level for the threat warning information generated by the cloud of the vehicle networking according to the threat level;

[0055] Step 3: Perform score calculations on the marked vehicle terminal security label level and cloud security label level respectively, and multiply the score corresponding to the vehicle terminal security label level by the vehicle terminal score weight + the score corresponding to the cloud security label level by the cloud score weight to obtain the overall vehicle networking security situation score.

[0056] The content not described in detail in this specification belongs to the prior art well-known to those skilled in the art.

Claims

1. A security condition scoring system for the security situation of the vehicle networking, characterized in that: It includes a vehicle - end threat warning server for the Internet of Vehicles, a cloud - end threat warning server for the Internet of Vehicles, and a security warning score calculation server for the Internet of Vehicles; The vehicle - end threat warning server for the Internet of Vehicles is used to label the corresponding vehicle - end security label level according to the threat level for the threat warning information generated by the vehicle - end of the Internet of Vehicles; The cloud - end threat warning server for the Internet of Vehicles is used to label the corresponding cloud - end security label level according to the threat level for the threat warning information generated by the cloud - end of the Internet of Vehicles; The security warning score calculation server for the Internet of Vehicles is used to perform score operations on the labeled vehicle - end security label level and the cloud - end security label level respectively, and multiply the score corresponding to the vehicle - end security label level by the vehicle - end score weight + the score corresponding to the cloud - end security label level by the cloud - end score weight to obtain the overall security situation score of the Internet of Vehicles; The method by which the security warning score calculation server for the Internet of Vehicles performs score operations on the labeled vehicle - end security label level is as follows: When there is exactly one level of vehicle - end security label in the labeled vehicle - end security label levels, it is the initial stage. The score corresponding to the vehicle - end security label level in the initial stage is [100 - ((11 - N) * 10+(-1) * X1 * 10)], where N is the vehicle - end security label level value and X1 is the number of alarms for this vehicle - end security label level that appear in the initial stage; The method by which the security warning score calculation server for the Internet of Vehicles performs score operations on the labeled vehicle - end security label level is as follows: When there are two or more levels of vehicle - end security labels in the labeled vehicle - end security label levels, it is the non - initial stage. The score corresponding to the vehicle - end security label level in the non - initial stage is [100-(z0 + z1 + z2 + z3 + z4 + z5 + z6 + z7 + z8 + z9 + z10)]; Among them, 0 ≤ N ≤ 10, and zN represents one of z0 to z10; Among them, 0 ≤ N ≤ 10, yN represents one of y0 to y10, xN is the number of alarms for this vehicle - end security label level that appear in the non - initial stage, and 0 ≤ xN; The value range of the operation result of the score corresponding to the vehicle - end security label level in the non - initial stage is an integer in the range of 0 to 100. Any number less than 0 is taken as 0, and any number greater than 100 is taken as 100.

2. The security status scoring display system for the vehicle networking security situation according to claim 1, characterized in that: The threat warning information of the vehicle - end of the Internet of Vehicles is generated by the log system or security log component of the vehicle - end of the Internet of Vehicles itself; the threat warning information of the cloud - end of the Internet of Vehicles is generated by the log system or security log component of the cloud - end of the Internet of Vehicles itself.

3. The security status scoring display system for the vehicle networking security situation according to claim 1, wherein: The vehicle - end security label levels corresponding to each threat alert message generated by the vehicle - end of the Internet of Vehicles are as follows: When the threat alert message of the vehicle - end of the Internet of Vehicles is normal service data, the vehicle - end security label level is level 0; when the threat alert message of the vehicle - end of the Internet of Vehicles is other types of alerts not listed, the vehicle - end security label level is level 1; when the threat alert message of the vehicle - end of the Internet of Vehicles is an ICMP - type alert, the vehicle - end security label level is level 2; when the threat alert message of the vehicle - end of the Internet of Vehicles is a port - scanning - type alert, the vehicle - end security label level is level 3; when the threat alert message of the vehicle - end of the Internet of Vehicles is an account - login - type alert, the vehicle - end security label level is level 4; when the threat alert message of the vehicle - end of the Internet of Vehicles is an account - brute - force - type alert, the vehicle - end security label level is level 5; when the threat alert message of the vehicle - end of the Internet of Vehicles is an abnormal CAN - bus message - type alert, the vehicle - end security label level is level 6; when the threat alert message of the vehicle - end of the Internet of Vehicles is an abnormal traffic - consumption - type alert, the vehicle - end security label level is level 7; when the threat alert message of the vehicle - end of the Internet of Vehicles is a malicious - application - type alert, the vehicle - end security label level is level 8; when the threat alert message of the vehicle - end of the Internet of Vehicles is a SHELL - operation - type alert, the vehicle - end security label level is level 9; when the threat alert message of the vehicle - end of the Internet of Vehicles is a system - control - type alert, the vehicle - end security label level is level 10.

4. The security status scoring and display system for the vehicle networking security situation according to claim 1, wherein: The cloud - end security label levels corresponding to each threat alert message generated by the cloud - end of the Internet of Vehicles are as follows: When the threat alert message of the cloud - end of the Internet of Vehicles is normal service data, the cloud - end security label level is level 0; when the threat alert message of the cloud - end of the Internet of Vehicles is other types of alerts not listed, the cloud - end security label level is level 1; when the threat alert message of the cloud - end of the Internet of Vehicles is an ICMP - type alert, the cloud - end security label level is level 2; when the threat alert message of the cloud - end of the Internet of Vehicles is a port - scanning - type alert, the cloud - end security label level is level 3; when the threat alert message of the cloud - end of the Internet of Vehicles is an account - login - type alert, the cloud - end security label level is level 4; when the threat alert message of the cloud - end of the Internet of Vehicles is an account - brute - force - type alert, the cloud - end security label level is level 5; when the threat alert message of the cloud - end of the Internet of Vehicles is a cross - site scripting attack alert, the cloud - end security label level is level 6; when the threat alert message of the cloud - end of the Internet of Vehicles is an SQL injection - type alert, the cloud - end security label level is level 7; when the threat alert message of the cloud - end of the Internet of Vehicles is an advanced - threat - attack - type alert, the cloud - end security label level is level 8; when the threat alert message of the cloud - end of the Internet of Vehicles is a SHELL - operation - type alert, the cloud - end security label level is level 9; when the threat alert message of the cloud - end of the Internet of Vehicles is a system - control - type alert, the cloud - end security label level is level 10.

5. The security status scoring display system for the vehicle networking security situation according to claim 1, wherein: The method by which the vehicle - end security alert score calculation server performs score calculation on the marked cloud - end security label levels is as follows: When there is and only one level of cloud - end security label appears in the marked cloud - end security label levels, it is the initial stage. The score corresponding to the cloud - end security label level in the initial stage is [100 - ((11 - M)*10+( - 1)*X2*10)], where M is the numerical value of the cloud - end security label level, and X2 is the number of times the alarm of this cloud - end security label level appears in the initial stage.

6. The security status scoring display system for the vehicle networking security situation according to claim 1, characterized in that: The method by which the vehicle - end security alert score calculation server performs score calculation on the marked cloud - end security label levels is as follows: When there are two or more cloud security label levels among the marked cloud security label levels, it is a non-initial stage. The score corresponding to the cloud security label level in the non-initial stage is [100 - (Z0 + Z1 + Z2 + Z3 + Z4 + Z5 + Z6 + Z7 + Z8 + Z9 + Z10)]; Among them, 0 ≤ M ≤ 10, and ZM represents one of Z0 to Z10; Among them, 0 ≤ M ≤ 10, YM represents one of Y0 to Y10, and XM is the number of times the alarm of this cloud security label level appears in the non-initial stage, 0 ≤ XM; The value range of the operation result of the score corresponding to the cloud security label level in the non-initial stage is an integer in the range of 0 to 100. Any number less than 0 is taken as 0, and any number greater than 100 is taken as 100.

7. The security status scoring display system for the vehicle networking security situation according to claim 1, characterized in that: The specific method for the vehicle networking security alarm score calculation server to obtain the overall vehicle networking security situation score by multiplying the score corresponding to the vehicle-end security label level by the vehicle-end score weight + multiplying the score corresponding to the cloud security label level by the cloud score weight is as follows: When the vehicle networking vehicle-end is in the primary stage and the vehicle networking cloud is in the primary stage, the overall vehicle networking security situation score is the score corresponding to the vehicle-end security label level in the initial stage multiplied by the vehicle-end score weight + the score corresponding to the cloud security label level in the initial stage multiplied by the cloud score weight; When the vehicle networking vehicle-end is in the non-primary stage and the vehicle networking cloud is in the non-primary stage, the overall vehicle networking security situation score is the score corresponding to the vehicle-end security label level in the non-initial stage multiplied by the vehicle-end score weight + the score corresponding to the cloud security label level in the non-initial stage multiplied by the cloud score weight; When the vehicle networking vehicle-end is in the primary stage and the vehicle networking cloud is in the non-primary stage, the overall vehicle networking security situation score is the score corresponding to the vehicle-end security label level in the initial stage multiplied by the vehicle-end score weight + the score corresponding to the cloud security label level in the non-initial stage multiplied by the cloud score weight; When the vehicle networking vehicle-end is in the non-primary stage and the vehicle networking cloud is in the primary stage, the overall vehicle networking security situation score is the score corresponding to the vehicle-end security label level in the non-initial stage multiplied by the vehicle-end score weight + the score corresponding to the cloud security label level in the initial stage multiplied by the cloud score weight.

8. A method for scoring the security status of the system according to claim 1, characterized in that: It includes the following steps: Step 1: Mark the corresponding vehicle-end security label level for the threat alarm information generated by the vehicle networking vehicle-end according to the threat level; Step 2: Mark the corresponding cloud security label level for the threat alarm information generated by the vehicle networking cloud according to the threat level; Step 3: Perform score operations on the marked vehicle-end security label level and cloud security label level respectively, and multiply the score corresponding to the vehicle-end security label level by the vehicle-end score weight + multiply the score corresponding to the cloud security label level by the cloud score weight to obtain the overall vehicle networking security situation score.

Images