A threat detection method, device, storage medium, and electronic device

Abstract

The present disclosure relates to a threat detection method, device, computer readable storage medium and electronic device. The threat detection method comprises: performing threat detection on packet data based on a threat detection rule set to obtain a first detection result; performing threat detection on the packet data based on an intelligent detection model to obtain a second detection result; in a case where the first detection result or the second detection result indicates that the packet data is abnormal, determining that the detection result is data abnormality; in a case where the first detection result and the second detection result are inconsistent, determining a controversial data set, and updating the threat detection rule set based on the controversial data set. The present disclosure can detect known threats and unknown threats, improve the overall detection rate, and reduce the false positive rate and the false negative rate.

Description

Technical Field

[0001] This disclosure relates to the field of information security, and in particular to a threat detection method, apparatus, storage medium, and electronic device. Background Technology

[0002] Common Controller Area Network (CAN) bus threat detection methods generally fall into two categories: intelligent analysis-based detection and rule-based detection. Rule-based methods detect threats by matching keywords or using statistical thresholds. Each method has its advantages and disadvantages. Intelligent analysis-based methods automatically summarize patterns and characteristics of abnormal packets from historical data to create models, performing well in detecting unknown threats but potentially resulting in false positives for known threats. Rule-based detection methods use predefined rules to match packet features; if the rules are met, a corresponding threat event is output. The effectiveness depends on the completeness of the rules and the accuracy of the threshold settings. Therefore, this method performs well in detecting known threats but may miss unknown threats. Summary of the Invention

[0003] To address at least one of the aforementioned technical problems, this disclosure provides a threat detection method, apparatus, storage medium, and electronic device.

[0004] According to one aspect of this disclosure, a threat detection method is provided, comprising: acquiring packet data in a controller local area network bus; performing threat detection on the packet data based on a set of threat detection rules to obtain a first detection result, wherein the set of threat detection rules includes at least one threat detection rule; performing threat detection on the packet data based on an intelligent detection model to obtain a second detection result; determining that the detection result is abnormal when the first detection result or the second detection result indicates that the packet data is abnormal, wherein the abnormal data includes at least one of replay attack, fuzzing attack, and denial-of-service attack; and determining a disputed dataset when the first detection result and the second detection result are inconsistent, and updating the threat detection rule set based on the disputed dataset, wherein the disputed dataset includes packet data with a detection result of data abnormality and first detection information and second detection information corresponding to the packet data.

[0005] In some possible implementations, the threat detection rules include period parameters and threshold parameters. The threat detection of the packet data based on these rules to obtain a first detection result includes at least one of the following: if the interval between occurrences of the packet data is less than the interval determined based on the period parameters, the first detection result of the packet data is determined to be a denial-of-service attack within data anomalies; if the number of consecutive occurrences of the packet data exceeds a preset number, and the payload of the packet data is random, the first detection result of the packet data is determined to be a fuzzy attack within data anomalies; if the interval between occurrences of the packet data exceeds the interval determined based on the period parameters, and the frequency of occurrence of the packet data exceeds a threshold determined based on the threshold parameters, the first detection result of the packet data is determined to be a replay attack within data anomalies.

[0006] In some possible implementations, the above-mentioned threat detection of the above-mentioned message data based on the intelligent detection model to obtain a second detection result includes: inputting the above-mentioned message data into the above-mentioned intelligent detection model; classifying and mapping the above-mentioned message data according to the classification mapping relationship of the above-mentioned message data in the above-mentioned intelligent detection model to obtain a classification result, wherein the classification result includes normal data or abnormal data, and the abnormal data includes at least one of replay attack, fuzzy attack, and denial-of-service attack; and determining the above-mentioned second detection result based on the classification result.

[0007] In some possible implementations, before obtaining the second detection result by performing threat detection on the message data based on the intelligent detection model, the method further includes: acquiring historical message data; preprocessing the historical message data, the preprocessing including at least one of data cleaning, data sampling, and data feature extraction; labeling the preprocessed historical message data, including: marking normal message data as normal and marking potentially threatening message data as abnormal; training the intelligent detection model based on the labeled historical message data, the intelligent detection model including at least one of Naive Bayes classification, support vector machine, decision tree, random forest, and neural network; and evaluating the trained intelligent detection model, the evaluation index including at least one of precision, accuracy, and recall of the intelligent detection model.

[0008] In some possible implementations, updating the threat detection rules based on the disputed dataset includes: when the first detection result indicates normal data and the second detection result indicates abnormal data: extracting data features from the disputed dataset; determining a first target classification mapping relationship based on the data features and the second detection result; determining a first target threat detection rule based on the first target classification mapping relationship; and adding the first target threat detection rule to the threat detection rule set.

[0009] In some possible implementations, updating the threat detection rule based on the disputed dataset further includes: when the first detection result indicates data anomaly and the second detection result indicates data normality: determining a second target threat detection rule based on the disputed dataset and the first detection result; determining a second target classification mapping relationship based on the disputed dataset and the second detection result; and updating the periodic parameters and threshold parameters of the second target threat detection rule based on the second target classification mapping relationship.

[0010] In some possible implementations, the method further includes: determining that the detection result is normal when both the first detection result and the second detection result indicate that the message data is normal.

[0011] According to a second aspect of this disclosure, a threat detection device is provided, the device comprising:

[0012] The data acquisition module is used to acquire message data in the controller area network bus;

[0013] The first detection module is used to perform threat detection on the above message data based on a set of threat detection rules to obtain a first detection result. The set of threat detection rules includes at least one threat detection rule.

[0014] The second detection module is used to perform threat detection on the above message data based on the intelligent detection model to obtain a second detection result;

[0015] The data anomaly determination module is used to determine that the detection result is a data anomaly when the first detection result or the second detection result indicates that the message data is abnormal. The data anomaly includes at least one of replay attack, fuzzy attack, and denial-of-service attack.

[0016] The rule update module is used to determine the disputed dataset when the first detection result and the second detection result are inconsistent, and to update the threat detection rule set based on the disputed dataset. The disputed dataset includes message data with a detection result of data abnormality and the first detection information and second detection information corresponding to the message data.

[0017] According to a third aspect of this disclosure, an electronic device is provided, including at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements the threat detection method as described in any one of the first aspects by executing the instructions stored in the memory.

[0018] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored therein, wherein the at least one instruction or at least one program is loaded and executed by a processor to implement the threat detection method as described in any one of the first aspects.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure.

[0020] Implementing this disclosure has the following beneficial effects: The technical solution of this disclosure obtains a first detection result by performing threat detection on message data based on a set of threat detection rules; obtains a second detection result by performing threat detection on message data based on an intelligent detection model; if the first detection result or the second detection result indicates that the message data is abnormal, the detection result is determined to be abnormal; if the first detection result and the second detection result are inconsistent, a disputed dataset is determined, and the threat detection rule set is updated based on the disputed dataset. The technical solution of this disclosure combines the advantages of intelligent detection and rule detection, which can detect both known threats and unknown threats, thereby improving the overall detection rate. At the same time, the improvement of detection rules based on intelligent detection can effectively reduce the false positive rate and the false negative rate.

[0021] Other features and aspects of this disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0022] To more clearly illustrate the technical solutions and advantages in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A flowchart illustrating a threat detection method according to an embodiment of the present disclosure is shown;

[0024] Figure 2 A flowchart illustrating a method for determining the type of data anomaly according to an embodiment of the present disclosure is shown.

[0025] Figure 3 A flowchart illustrating a threat detection method based on an intelligent detection model according to an embodiment of the present disclosure is shown.

[0026] Figure 4 A schematic flowchart of a training method for an intelligent detection model according to an embodiment of the present disclosure is shown.

[0027] Figure 5 This diagram illustrates a method for updating threat detection rules according to an embodiment of the present disclosure.

[0028] Figure 6 This diagram illustrates a method flow chart for updating threat detection rules according to an embodiment of the present disclosure.

[0029] Figure 7 This diagram illustrates a block diagram of a threat detection apparatus according to an embodiment of the present disclosure;

[0030] Figure 8 A block diagram of an electronic device according to an embodiment of the present disclosure is shown;

[0031] Figure 9 A block diagram of another electronic device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0032] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0033] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0034] Various exemplary embodiments, features, and aspects of this disclosure will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0035] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0036] In this document, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0037] Furthermore, to better illustrate this disclosure, numerous specific details are set forth in the following detailed description. Those skilled in the art will understand that this disclosure can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art have not been described in detail in order to highlight the main points of this disclosure.

[0038] Figure 1 This diagram illustrates a flowchart of a threat detection method according to an embodiment of the present disclosure, as shown below. Figure 1 As shown, the above method includes:

[0039] S10: Obtain message data from the controller area network bus.

[0040] In this embodiment of the disclosure, message data refers to the components of information transmitted from a source node to a destination node in a computer network. Message data typically contains data content to be transmitted by protocols at layers below the network layer. In network communication, message data is divided into many small blocks for transmission, each block being called a data packet. In addition to containing actual data, data packets also contain control information for data transmission, such as the addresses of the source and destination nodes.

[0041] A message generally consists of two parts: a header and a body. The header typically contains information such as the sender's and receiver's addresses, protocol type, data type, data length, and checksum, used for identifying and verifying the message during transmission. The body contains the actual data content, which may include different fields and data formats depending on the application scenario, such as text, binary data, images, and audio.

[0042] S20: Perform threat detection on the above message data based on the threat detection rule set to obtain a first detection result. The threat detection rule set includes at least one threat detection rule.

[0043] This disclosure does not limit the threat detection rules included in the above-described threat detection rule set. For example, the threat detection rules can be considered from the following perspectives:

[0044] Regarding data length detection rules: The message data length on the Controller Area Network (CAN) bus should conform to the protocol specifications. The presence of a threat can be determined by checking whether the message data length complies with the protocol specifications. For example, checking whether the message data length is less than or equal to 8 bytes, or whether it exceeds the maximum data length, etc.

[0045] Detection rules for data content: The message data content on the controller area network bus should conform to the protocol specifications. The presence of threats can be determined by detecting whether the message data content conforms to the protocol specifications. For example, detecting whether the message data contains illegal control characters, commands that do not conform to the protocol, or abnormal data, etc.

[0046] Regarding the detection rules for message frequency: The message transmission frequency on the controller area network bus should conform to normal operation. The presence of a threat can be determined by detecting whether the message transmission frequency is within the normal range. For example, this includes detecting whether the time interval between message transmissions is abnormally short, or whether there are abnormal message transmission frequencies.

[0047] Message order detection rules: The message transmission order on the controller area network bus should conform to the protocol specifications. The presence of a threat can be determined by detecting whether the message transmission order conforms to the protocol specifications. For example, this includes checking whether the message transmission order meets protocol requirements and whether there are any abnormal transmission sequences.

[0048] Detection rules for abnormal message content: Message data on the controller area network bus should conform to normal operation. The presence of threats can be determined by detecting abnormal content in the message data. For example, detecting abnormal data types or malicious code in the message.

[0049] In some possible embodiments, the threat detection rules mentioned above include periodic parameters and threshold parameters. The threat detection of the packet data based on the threat detection rules to obtain a first detection result includes, for example: Figure 2 At least one of the following situations is shown:

[0050] S201: If the interval between occurrences of the above message data is less than the interval determined based on the above periodic parameters, the first detection result of the above message data is determined to be a denial-of-service attack in the data anomaly.

[0051] Denial-of-Service (DoS) attacks on the CAN bus occur when an attacker sends a large amount of invalid data or data that consumes excessive bus bandwidth onto the CAN bus, preventing legitimate data from being transmitted or processed correctly, thus malfunctioning the system. The CAN bus is a communication bus with high real-time requirements; excessive bus bandwidth consumption can lead to system performance degradation or even crashes. Therefore, DoS attacks on the CAN bus pose a threat to the stability and reliability of the system.

[0052] In one specific embodiment, the message data is periodically detected in frames. If the interval between the occurrence of messages with the same flag is less than 5 milliseconds, it is determined that this is a denial-of-service attack. That is, the first detection result of the message data at this time is a denial-of-service attack in the data anomaly.

[0053] S202: If the number of consecutive occurrences of the above message data exceeds a preset number, and the payload of the above message data is random, the first detection result of the above message data is determined to be a fuzzy attack in the data anomaly.

[0054] In the CAN bus, fuzzing attacks are physical layer-based attacks that typically interfere with communication on the CAN bus by sending noise signals with specific characteristics. These noise signals can be short or long pulses, or variations in frequency, amplitude, or phase. Fuzzing attacks can disrupt communication on the CAN bus, causing data packet transmission errors or duplicate transmissions, ultimately threatening the vehicle's functionality and safety. To prevent fuzzing attacks, physical layer security measures can be implemented, such as adding electromagnetic shielding and using error detection and correction codes.

[0055] In one specific embodiment, when a large number of message data with consecutive flags and random message content are detected, it is determined that the system has encountered a fuzzy attack. That is, the first detection result of the message data at this time is a fuzzy attack in the data anomaly.

[0056] S203: If the interval between occurrences of the above-mentioned message data is greater than the interval determined based on the above-mentioned periodic parameter, and the frequency of occurrence of the above-mentioned message data is greater than the threshold determined based on the above-mentioned threshold parameter, the first detection result of the above-mentioned message data is determined to be a replay attack in data anomalies.

[0057] In the CAN bus, a replay attack refers to an attacker intercepting CAN messages during normal communication and retransmitting them onto the bus, thereby deceiving bus nodes into believing that the messages originated from legitimate nodes. Through replay attacks, attackers can perform malicious operations, such as controlling certain systems of a vehicle, like the braking or acceleration systems. To prevent replay attacks on the CAN bus, encryption and authentication technologies can be used to protect CAN messages, ensuring their integrity and the authenticity of their origin.

[0058] In a specific embodiment, periodic detection is performed on a single frame of packets. If the packet data with the same flag has a periodic anomaly more than 10 times (that is, the threshold parameter is 10 at this time), but the period interval is greater than 5 milliseconds, it is detected as a replay attack. That is, the first detection result of the packet data is a replay attack in the data anomaly. The period interval is set to prevent confusion with the above-mentioned DoS attack.

[0059] S30: Based on the intelligent detection model, threat detection is performed on the above message data to obtain the second detection result.

[0060] Figure 3 This illustration shows a flowchart of a method for threat detection of message data based on an intelligent detection model, according to an embodiment of this disclosure. Figure 3 As shown, the above method includes:

[0061] S301: Input the above message data into the above intelligent detection model.

[0062] S302: Based on the above message data classification mapping relationship in the above intelligent detection model, the above message data is classified and mapped to obtain a classification result. The above classification result includes normal data or abnormal data. The above abnormal data includes at least one of replay attack, fuzzy attack, and denial-of-service attack.

[0063] S303: Based on the above classification results, the above second detection result is determined.

[0064] In this embodiment of the disclosure, the intelligent detection model can continuously classify and map real-time message data streams. Based on the classification results, it can determine whether the data may be threatening or abnormal, thus obtaining a second detection result. For example, if the classification result indicates that the data is normal, the second detection result indicates that the data is normal; if the classification result indicates that the data is abnormal and contains a fuzzy attack, the second detection result indicates that the data is fuzzy.

[0065] In some possible implementations, before obtaining the second detection result by performing threat detection on the aforementioned message data based on the intelligent detection model, the method further includes training the intelligent detection model, such as... Figure 4As shown, the training of the intelligent detection model includes the following steps:

[0066] S3001: Obtain historical message data and preprocess the aforementioned historical message data. The preprocessing includes at least one of data cleaning, data sampling, and data feature extraction.

[0067] S3002: Mark the above-mentioned historical message data after the above preprocessing, including: marking normal message data as normal, and marking message data that may pose a threat as abnormal.

[0068] S3003: Train the above-mentioned intelligent detection model based on the historical message data after the above annotation. The intelligent detection model includes at least one of the following intelligent algorithms: Naive Bayes classification, support vector machine, decision tree, random forest, and neural network.

[0069] S3004: Evaluate the trained intelligent detection model, wherein the evaluation metrics include at least one of the precision, accuracy, and recall of the intelligent detection model.

[0070] In this embodiment, training the aforementioned intelligent detection model can improve detection accuracy. The intelligent detection model can learn from large amounts of data and summarize it into certain patterns or features, thereby more accurately classifying or detecting unknown data. Secondly, the intelligent detection model can automate data processing and decision-making without human intervention, thus improving work efficiency. Furthermore, the intelligent detection model can monitor and process data in real time, reacting quickly to anomalies and ensuring system real-time performance. In addition, the intelligent detection model can replace some manual detection work, thereby reducing related costs. Finally, the intelligent detection model can be continuously optimized and iterated according to different needs and datasets, adapting it to more application scenarios. In summary, training the intelligent detection model can bring benefits and effects in terms of improved accuracy, increased efficiency, strong real-time performance, reduced costs, and strong iterability.

[0071] S40: If the first detection result or the second detection result indicates that the message data is abnormal, the detection result is determined to be abnormal, and the abnormal data includes at least one of replay attack, obfuscation attack, and denial-of-service attack.

[0072] In this embodiment of the disclosure, if either the first detection result based on rules or the second detection result based on an intelligent detection model indicates that the message data is abnormal, then a threat is considered to exist. This judgment relationship can maximize the detection of threats, reduce the false negative rate, and ensure the security of the system.

[0073] In a specific embodiment, if the first detection result is data anomaly and the second detection result is a replay attack within the data anomaly, then it can be determined that the detection result at this time is a replay attack within the data anomaly.

[0074] In another specific embodiment, if the first detection result is a denial-of-service attack in the data anomaly and the second detection result is normal data, then it can be determined that the detection result at this time is a denial-of-service attack in the data anomaly.

[0075] S50: If the first detection result and the second detection result are inconsistent, determine the disputed dataset, and update the threat detection rule set based on the disputed dataset. The disputed dataset includes message data with abnormal detection results and the first and second detection information corresponding to the message data.

[0076] In a specific embodiment, the aforementioned disputed dataset is presented in the form of a data table, which includes several columns of data, such as the serial number, timestamp, message period, CAN bus identification information, message content, channel information corresponding to the message, original tag, first detection result, second detection result, and data index information of the message.

[0077] Furthermore, in embodiments of this disclosure, if both the first detection result and the second detection result indicate that the message data is normal, the detection result is determined to be normal.

[0078] like Figure 5 As shown, updating the threat detection rules based on the aforementioned disputed dataset includes the following steps:

[0079] S501: When the first test result above indicates normal data, and the second test result above indicates abnormal data:

[0080] S5011: Extract the data features of the aforementioned disputed dataset.

[0081] S5012: Based on the above data features and the above second detection results, determine the first target classification mapping relationship.

[0082] In this embodiment of the disclosure, the aforementioned first target classification mapping relationship is the classification mapping relationship corresponding to the disputed data in the intelligent detection model.

[0083] In a specific embodiment, the data feature extracted by the intelligent detection model is the appearance of 8 consecutively marked message data, and the content of these consecutively marked message data is random. At this time, the second detection result is a replay attack. The first target classification mapping relationship at this time is: if 8 consecutively marked message data with random content appear, it is determined to be a replay attack.

[0084] S5013: Determine the first target threat detection rule based on the above first target classification mapping relationship, and add the above first target threat detection rule to the above threat detection rule set.

[0085] In the above scenario, the first detection result based on existing rules is normal, while the second detection result based on the intelligent detection model is data anomaly. This indicates that the detected threat may be an unknown threat. At this point, based on the second detection result, we analyze which data features of the message data were used to determine that it was data anomaly. We then supplement these data features and their corresponding classification mapping relationships into the threat detection rules, thereby updating the threat detection rule set. When the same type of threat is encountered again, the first detection result based on the rules will also be updated to data anomaly, making it applicable to a wider range of scenarios.

[0086] like Figure 6 As shown, updating the threat detection rules based on the aforementioned disputed dataset may also include the following steps:

[0087] S502: When the first test result above indicates abnormal data, and the second test result above indicates normal data:

[0088] S5021: Determine the second target threat detection rule based on the above disputed dataset and the above first detection result.

[0089] S5022: Determine the second target classification mapping relationship based on the above-mentioned controversial dataset and the above-mentioned second detection results.

[0090] In this embodiment of the disclosure, the second target detection rule is the threat detection rule corresponding to the disputed dataset, and the second target classification mapping relationship is the classification mapping relationship corresponding to the disputed dataset in the intelligent detection model.

[0091] In a specific embodiment, if the first detection result is a denial-of-service attack in the data anomaly, then the corresponding second target threat detection rule is the detection rule that determines it to be a denial-of-service attack; the second target classification mapping relationship is the classification mapping relationship in the intelligent detection model that determines it to be normal data.

[0092] S5023: Update the periodic parameters and threshold parameters of the above second target threat detection rule based on the above second target classification mapping relationship.

[0093] In the above scenario, the first detection result based on existing rules indicates data anomaly, meaning that the detected threat is a known threat. The second detection result based on the intelligent detection model indicates normal data. Since the intelligent detection model is constantly updated and iterated, the parameters of the detection rule corresponding to this anomaly need to be updated to make its detection effect more accurate. For example, in some cases, the threshold parameter for replay attacks is 5. However, through the learning of the intelligent detection model, it is believed that setting the threshold parameter to 10 can more accurately identify replay attacks. In this case, the corresponding threshold parameter in the threat detection rule set can be adjusted to 10.

[0094] The introduction of a period parameter in this technical solution can also reduce the false alarm rate. Analysis of the rule-based detection process reveals that rules determine DoS attacks and replay attacks by recording the timestamps and periods of historical packet data. However, historical packet records outside a certain period can negatively impact the detection at the current moment. Therefore, by improving the rules and limiting the recording period of historical packet timestamps to one sending period, false alarms caused by replay attacks and DoS attacks compared to normal packets are eliminated.

[0095] The threshold parameter in this technical solution is used to determine the abnormality of the current batch of packets. If the set threshold is not met, the DoS packet will not be identified as an abnormal packet by rule-based detection; it will only be reported when the set threshold is met during statistical analysis of the current batch of packets. A DoS attack is not just an attack on a single packet; it is a complete event that consumes the overall bus resources. For this type of abnormal attack, intelligent detection models, especially those based on recurrent neural networks, can extract features from sequence segments and summarize them into a complete abnormal event for reporting. While rule-based detection can report only a complete event through statistical processing, due to its inherent detection mechanism limitations, it cannot pinpoint the location of the attack like intelligent detection models.

[0096] Rule-based detection distinguishes between replay attacks and DoS attacks by setting thresholds and statistically analyzing abnormal periodic packets. Because their detection principles are similar, both attacks are prone to false positives when anomalies are reported. Intelligent detection models, however, extract the state characteristics of the current packet within the overall network flow by correlating preceding and following packet traffic and summarizing the packet sequence's own characteristics, thereby identifying abnormal events. This characteristic of intelligent detection models plays a crucial role in identifying DoS and replay attacks. Analysis reveals that both replay and DoS attacks inject normal packets into the bus, but their objectives differ. Replay replays some packets on the bus, causing related packet information to repeatedly affect relevant electronic control units, resulting in unexpected dangerous events. DoS attacks, on the other hand, continuously inject high-priority packets to occupy in-vehicle bus resources, thereby blocking normal in-vehicle network communication. The most significant difference between the two attacks lies in the degree of in-vehicle resource occupation: replay does not block in-vehicle communication, while DoS does. Therefore, rule detection can be improved by combining periodic anomaly statistics with load rate detection, thereby better distinguishing between replay attacks and DoS attacks.

[0097] Fuzzy attacks are a penetration testing method that generates a series of random, invalid, or unexpected messages and sends them to the target bus to induce unexpected behavior on the target bus. This characteristic makes it difficult to formulate reasonable conditions or thresholds to effectively detect such attacks. However, recurrent neural network algorithms can learn to construct fuzzy features and explore the inherent patterns within the context, effectively detecting these attacks. Therefore, the technical solution disclosed in this paper can reduce the false negative and false positive rates of system threats.

[0098] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0099] It is understood that the various method embodiments mentioned above in this disclosure can be combined with each other to form combined embodiments without violating the principle and logic. Due to space limitations, this disclosure will not elaborate further.

[0100] Figure 7 A block diagram of a threat detection apparatus according to an embodiment of the present disclosure is shown; as follows: Figure 7 As shown, the above-mentioned device includes:

[0101] Data acquisition module 101 is used to acquire message data in the controller local area network bus;

[0102] The first detection module 102 is used to perform threat detection on the above message data based on a set of threat detection rules to obtain a first detection result. The set of threat detection rules includes at least one threat detection rule.

[0103] The second detection module 103 is used to perform threat detection on the above message data based on the intelligent detection model to obtain a second detection result;

[0104] The data anomaly determination module 104 is used to determine that the detection result is a data anomaly when the first detection result or the second detection result indicates that the message data is abnormal. The data anomaly includes at least one of replay attack, fuzzy attack, and denial-of-service attack.

[0105] The rule update module 105 is used to determine the disputed dataset when the first detection result and the second detection result are inconsistent, and update the threat detection rule set based on the disputed dataset. The disputed dataset includes message data with a detection result of data abnormality and the first detection information and second detection information corresponding to the message data.

[0106] In some possible implementations, the threat detection rules include periodic parameters and threshold parameters. The first detection module 102 performs threat detection on the packet data based on the threat detection rules to obtain a first detection result, including at least one of the following: if the interval between occurrences of the packet data is less than the interval determined based on the periodic parameters, the first detection result of the packet data is determined to be a denial-of-service attack in data anomalies; if the number of consecutive occurrences of the packet data is greater than a preset number, and the payload of the packet data is random, the first detection result of the packet data is determined to be a fuzzy attack in data anomalies; if the interval between occurrences of the packet data is greater than the interval determined based on the periodic parameters, and the frequency of occurrence of the packet data is greater than the threshold determined based on the threshold parameters, the first detection result of the packet data is determined to be a replay attack in data anomalies.

[0107] In some possible implementations, the second detection module 103 performs threat detection on the aforementioned message data based on an intelligent detection model to obtain a second detection result, including: inputting the aforementioned message data into the aforementioned intelligent detection model; classifying and mapping the aforementioned message data based on the aforementioned message data classification mapping relationship in the aforementioned intelligent detection model to obtain a classification result, wherein the aforementioned classification result includes data normal or data abnormal, wherein the aforementioned data abnormality includes at least one of replay attack, fuzzy attack, and denial-of-service attack; and determining the aforementioned second detection result based on the aforementioned classification result.

[0108] In some possible implementations, the threat detection device further includes a training module 106, which is used to train the intelligent detection model. This includes acquiring historical message data, preprocessing the historical message data (including at least one of data cleaning, data sampling, and data feature extraction), labeling the preprocessed historical message data (including marking normal message data as normal and potentially threatening message data as abnormal), training the intelligent detection model based on the labeled historical message data (the intelligent algorithm included in the intelligent detection model includes at least one of Naive Bayes classification, support vector machine, decision tree, random forest, and neural network), and evaluating the trained intelligent detection model (the evaluation metrics include at least one of precision, accuracy, and recall of the intelligent detection model).

[0109] In some possible implementations, the rule update module 105 updates the threat detection rules based on the disputed dataset, including: when the first detection result is that the data is normal and the second detection result is that the data is abnormal: extracting data features from the disputed dataset; determining a first target classification mapping relationship based on the data features and the second detection result; determining a first target threat detection rule based on the first target classification mapping relationship; and adding the first target threat detection rule to the threat detection rule set.

[0110] In some possible implementations, the rule update module 105 updates the threat detection rules based on the disputed dataset, and further includes: when the first detection result is data anomaly and the second detection result is data normal: determining a second target threat detection rule based on the disputed dataset and the first detection result; determining a second target classification mapping relationship based on the disputed dataset and the second detection result; and updating the periodic parameters and threshold parameters of the second target threat detection rule based on the second target classification mapping relationship.

[0111] In some possible implementations, the data anomaly determination module 104 is further configured to determine that the detection result is normal when both the first detection result and the second detection result indicate that the message data is normal.

[0112] In some embodiments, the functions or modules of the apparatus provided in this disclosure can be used to execute the threat detection method described in the above embodiments. The specific implementation can be referred to the description in the above embodiments, and for the sake of brevity, it will not be repeated here.

[0113] This disclosure also proposes a computer-readable storage medium storing at least one instruction or at least one program segment, which, when loaded and executed by a processor, implements the aforementioned method. The computer-readable storage medium may be a non-volatile computer-readable storage medium.

[0114] This disclosure also proposes an electronic device, including: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured for the aforementioned threat detection method.

[0115] Electronic devices can be provided as terminals, servers, or other forms of devices.

[0116] Figure 8 This diagram illustrates a block diagram of an electronic device according to an embodiment of the present disclosure. For example, the electronic device 800 may be a mobile phone, computer, digital broadcasting terminal, messaging device, game console, tablet device, medical device, fitness equipment, personal digital assistant, or other terminal.

[0117] Reference Figure 8 The electronic device 800 may include one or more of the following components: a processing component 802, a memory 804, a power supply component 806, a multimedia component 808, an audio component 810, an input / output (I / O) interface 812, a sensor component 814, and a communication component 816.

[0118] Processing component 802 typically controls the overall operation of electronic device 800, such as operations associated with display, telephone calls, data communication, camera operation, and recording operations. Processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the methods described above. Furthermore, processing component 802 may include one or more modules to facilitate interaction between processing component 802 and other components. For example, processing component 802 may include a multimedia module to facilitate interaction between multimedia component 808 and processing component 802.

[0119] Memory 804 is configured to store various types of data to support the operation of electronic device 800. Examples of this data include instructions for any application or method operating on electronic device 800, contact data, phonebook data, messages, pictures, videos, etc. Memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0120] Power supply component 806 provides power to various components of electronic device 800. Power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to electronic device 800.

[0121] Multimedia component 808 includes a screen that provides an output interface between the aforementioned electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 808 includes a front-facing camera and / or a rear-facing camera. When the electronic device 800 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0122] Audio component 810 is configured to output and / or input audio signals. For example, audio component 810 includes a microphone (MIC) configured to receive external audio signals when electronic device 800 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 804 or transmitted via communication component 816. In some embodiments, audio component 810 also includes a speaker for outputting audio signals.

[0123] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0124] Sensor assembly 814 includes one or more sensors for providing state assessments of various aspects of electronic device 800. For example, sensor assembly 814 can detect the on / off state of electronic device 800, the relative positioning of components such as the display and keypad of electronic device 800, changes in position of electronic device 800 or a component of electronic device 800, the presence or absence of user contact with electronic device 800, orientation or acceleration / deceleration of electronic device 800, and temperature changes of electronic device 800. Sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 814 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 814 may also include an accelerometer, gyroscope, magnetometer, pressure sensor, or temperature sensor.

[0125] Communication component 816 is configured to facilitate wired or wireless communication between electronic device 800 and other devices. Electronic device 800 can access wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G, 5G, or combinations thereof. In one exemplary embodiment, communication component 816 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the aforementioned communication component 816 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0126] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the threat detection method described above.

[0127] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 804 including computer program instructions, which can be executed by a processor 820 of an electronic device 800 to perform the threat detection method described above.

[0128] Figure 9 A block diagram of another electronic device according to an embodiment of the present disclosure is shown. For example, electronic device 1900 may be provided as a server. (Refer to...) Figure 9The electronic device 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the aforementioned threat detection method.

[0129] Electronic device 1900 may also include a power supply component 1926 configured to perform power management of electronic device 1900, a wired or wireless network interface 1950 configured to connect electronic device 1900 to a network, and an input / output (I / O) interface 1958. Electronic device 1900 can operate on an operating system stored in memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or similar.

[0130] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of an electronic device 1900 to perform the threat detection method described above.

[0131] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0132] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0133] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0134] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0135] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0136] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0137] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0138] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which includes one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions specified in the blocks may occur in a different order than those specified in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0139] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A threat detection method, characterized in that, The method includes: Retrieve message data from the controller area network bus; A first detection result is obtained by performing threat detection on the packet data based on a set of threat detection rules, wherein the set of threat detection rules includes at least one threat detection rule. A second detection result is obtained by performing threat detection on the message data based on an intelligent detection model. In the event that the first detection result or the second detection result indicates that the message data is abnormal. The detection result is determined to be data anomaly, and the data anomaly includes at least one of replay attack, fuzzing attack, and denial-of-service attack; In cases where the first detection result and the second detection result are inconsistent, a disputed dataset is determined, and the threat detection rule set is updated based on the disputed dataset. The disputed dataset includes message data with anomaly detection results and corresponding first and second detection information. Updating the threat detection rule set based on the disputed dataset includes: when the first detection result indicates normal data and the second detection result indicates abnormal data; extracting data features from the disputed dataset; determining a first target classification mapping relationship based on the data features and the second detection result; determining a first target threat detection rule based on the first target classification mapping relationship; and adding the first target threat detection rule to the threat detection rule set. Updating the threat detection rule set based on the disputed dataset further includes: when the first detection result indicates abnormal data and the second detection result indicates normal data; determining a second target threat detection rule based on the disputed dataset and the first detection result; determining a second target classification mapping relationship based on the disputed dataset and the second detection result; and updating the periodic parameters and threshold parameters of the second target threat detection rule based on the second target classification mapping relationship.

2. The method according to claim 1, characterized in that, The threat detection rule includes a periodic parameter and a threshold parameter. The step of performing threat detection on the packet data based on the threat detection rule to obtain a first detection result includes at least one of the following: If the interval between occurrences of the message data is less than the interval determined based on the period parameter, the first detection result of the message data is determined to be a denial-of-service attack in the data anomaly. If the number of consecutive occurrences of the message data exceeds a preset number, and the payload of the message data is random, the first detection result of the message data is determined to be a fuzzy attack in the data anomaly. If the interval between occurrences of the message data is greater than the interval determined based on the period parameter, and the frequency of occurrence of the message data is greater than the threshold determined based on the threshold parameter, then the first detection result of the message data is determined to be a replay attack in data anomalies.

3. The method according to claim 1 or 2, characterized in that, The second detection result obtained by performing threat detection on the message data based on the intelligent detection model includes: Input the message data into the intelligent detection model; Based on the message data classification mapping relationship in the intelligent detection model, the message data is classified and mapped to obtain a classification result. The classification result includes normal data or abnormal data. The abnormal data includes at least one of replay attack, fuzzy attack, and denial-of-service attack. The second detection result is determined based on the classification result.

4. The method according to claim 3, characterized in that, Before obtaining the second detection result by performing threat detection on the message data based on the intelligent detection model, the method further includes: Obtain historical message data and preprocess the historical message data, wherein the preprocessing includes at least one of data cleaning, data sampling, and data feature extraction; The preprocessed historical message data is labeled, including: labeling normal message data as normal and labeling potentially threatening message data as abnormal; The intelligent detection model is trained based on the labeled historical message data. The intelligent detection model includes at least one of the following intelligent algorithms: Naive Bayes classification, support vector machine, decision tree, random forest, and neural network. The trained intelligent detection model is evaluated, and the evaluation metrics include at least one of the precision, accuracy, and recall of the intelligent detection model.

5. The method according to claim 1, characterized in that, The method further includes: If both the first and second detection results indicate that the message data is normal, the detection result is determined to be normal.

6. A threat detection device, characterized in that, The device includes: The data acquisition module is used to acquire message data in the controller area network bus; The first detection module is used to perform threat detection on the packet data based on a set of threat detection rules to obtain a first detection result, wherein the set of threat detection rules includes at least one threat detection rule. The second detection module is used to perform threat detection on the message data based on the intelligent detection model to obtain a second detection result; The data anomaly determination module is used to determine that the detection result is a data anomaly when the first detection result or the second detection result indicates that the message data is abnormal. The data anomaly includes at least one of replay attack, obfuscation attack, and denial-of-service attack. The rule update module is used to determine a disputed dataset when the first detection result and the second detection result are inconsistent, and to update the threat detection rule set based on the disputed dataset. The disputed dataset includes message data with anomaly detection results and corresponding first and second detection information. The rule update module is also used to: extract data features from the disputed dataset when the first detection result is normal and the second detection result is abnormal; determine a first target classification mapping relationship based on the data features and the second detection result; determine a first target threat detection rule based on the first target classification mapping relationship; and add the first target threat detection rule to the threat detection rule set. Furthermore, the rule update module is used to: determine a second target threat detection rule based on the disputed dataset and the first detection result when the first detection result is abnormal and the second detection result is normal; determine a second target classification mapping relationship based on the disputed dataset and the second detection result; and update the periodic parameters and threshold parameters of the second target threat detection rule based on the second target classification mapping relationship.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction or at least one program, which is loaded and executed by a processor to implement the threat detection method as described in any one of claims 1 to 5.

8. An electronic device, characterized in that, The system includes at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements the threat detection method as described in any one of claims 1 to 5 by executing the instructions stored in the memory.

Images