Vulnerability tracing method and device based on automobile attack link

Abstract

The present invention provides a vulnerability tracing method based on an automobile attack link, comprising: obtaining vulnerability information from multiple sources; the multiple sources include vulnerability reports, attack cases, and security research papers; the vulnerability information includes the vulnerability type, attack method, and affected components of each vulnerability; processing the vulnerability information according to a machine learning algorithm to obtain an original automobile attack link model; verifying the original automobile attack link model to obtain a target automobile attack link model; the target automobile attack link model includes the component where the vulnerability is located, the attack method, the vulnerability-affected component, and the attack link; when the current vulnerability is obtained, determining the vulnerability-affected component and the attack link according to the component where the current vulnerability is located, the attack method, and the target automobile attack link model.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a vulnerability tracing method and device based on an automobile attack link. Background Art

[0002] As the degree of intelligence and interconnection of automotive systems increases, automobiles face increasing cybersecurity threats. Attackers can exploit vulnerabilities to invade automotive systems and cause harm to vehicles and drivers. Therefore, the demand for vulnerability management and security protection by automobile manufacturers and suppliers is becoming increasingly urgent. Traditional vulnerability management methods mainly rely on vulnerability databases and manual analysis, which have problems such as low vulnerability tracing efficiency and unclear attack paths. It is difficult to trace the origin of vulnerabilities and attack paths. Existing security frameworks such as Common Vulnerabilities and Exposures (CVE) provide vulnerability identification and description, but they are more of a single point description. Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) is a knowledge base for describing and classifying threat behaviors, but it is more targeted at IT systems and lacks relevance to specific automotive systems and the presentation of attack links.

[0003] At present, some vulnerability management methods focus on vulnerability discovery and repair, but lack in-depth research on vulnerability tracing. Current vulnerability tracing methods are mainly based on public vulnerability databases and security bulletin information, and trace the source by analyzing the description and impact range of the vulnerability. However, this method usually relies on manual analysis and manual inference, which is inefficient and susceptible to subjective factors. Existing technologies also have certain limitations in attack link modeling in the automotive field. The following are some existing technical solutions:

[0004] 1) Vulnerability database and security bulletin: Use known vulnerability information and security bulletins to describe and classify vulnerabilities. However, this information often lacks relevance to specific automotive systems and cannot provide information on the attack path of the vulnerability.

[0005] 2) Vulnerability scanning tools: Identify potential vulnerabilities by scanning the code and configuration files of the car system. However, these tools only focus on the existence of vulnerabilities and do not provide the attack chain and traceability capabilities of the vulnerabilities.

[0006] 3) Vulnerability analysis platform: It integrates vulnerability scanning, code analysis, and security testing functions for vulnerability assessment and analysis. However, these platforms lack detailed modeling and visualization of vulnerability attack paths.

[0007] 4) Automotive security framework: including automotive security standards and guidelines, providing some security recommendations and best practices. However, these frameworks usually lack comprehensive analysis of vulnerabilities and modeling of attack links.

[0008] Existing technical solutions usually rely on manual analysis and artificial inference, which are inefficient and easily affected by subjective factors. They also lack the ability to comprehensively model and trace the vulnerability attack chain, and are unable to provide fast and efficient vulnerability tracing solutions.

[0009] Existing vulnerability tracing methods have some shortcomings in the automotive field, mainly including the following aspects:

[0010] 1) Lack of fine-grained attack chain modeling: Existing methods simplify the attack chain modeling of automotive systems and cannot accurately describe the relationship between various attack behaviors and vulnerabilities. This leads to insufficient visualization and analysis capabilities of attack paths during vulnerability tracing.

[0011] 2) Reliance on manual analysis and expert judgment: Existing methods often rely on expert experience and manual analysis, which is time-consuming and error-prone to trace and locate vulnerabilities. This limits the efficiency and accuracy of the traceability process.

[0012] Therefore, a vulnerability tracing method based on the automotive attack link is needed to provide fast and efficient vulnerability tracing capabilities. Summary of the invention

[0013] The purpose of the embodiments of the present invention is to provide a vulnerability tracing method and device system based on an automobile attack link to solve the problems existing in the prior art.

[0014] In a first aspect, the present invention provides a vulnerability tracing method based on an automobile attack link, the vulnerability tracing method based on an automobile attack link comprising:

[0015] Obtain vulnerability information from multiple sources; the multiple sources include vulnerability reports, attack cases, and security research papers; the vulnerability information includes the vulnerability type, attack method, and affected components of each vulnerability;

[0016] Processing the vulnerability information according to a machine learning algorithm to obtain an original automobile attack link model;

[0017] The original car attack link model is verified to obtain a target car attack link model; the target car attack link model includes the component where the vulnerability is located, the attack method, the vulnerability-affected component and the attack link;

[0018] When the current vulnerability is obtained, the vulnerability-affected components and attack links are determined based on the component where the current vulnerability is located, the attack method, and the target vehicle attack link model.

[0019] In a possible implementation, the vulnerability types include: information leakage vulnerability, remote code execution vulnerability and privilege escalation vulnerability; the attack methods include remote code execution attack, CAN bus attack and relay attack; the affected components include: in-vehicle infotainment system IVI, Bluetooth key, near-field communication NFC key.

[0020] In a possible implementation, the processing of the vulnerability information according to the machine learning algorithm to obtain the original automobile attack link model specifically includes:

[0021] Determine the attack mode of each vulnerability, the component where it is located, and at least one affected component affected by the vulnerability according to the clustering algorithm and the association rule mining algorithm;

[0022] According to the ATT&CK knowledge base, map each vulnerability to the ATT&CK knowledge base to determine at least one attack link of the vulnerability;

[0023] After associating the attack mode of each vulnerability, the component where it is located, at least one affected component of the vulnerability, and at least one attack link of the vulnerability, the original automobile attack link model is obtained.

[0024] In a possible implementation, verifying the original automobile attack link model to obtain the target automobile attack link model specifically includes:

[0025] Input any vulnerability information into the original automobile attack link model;

[0026] When the attack link cannot be output, it is determined that the training of the original car attack link model has failed;

[0027] When the attack link is output, the output attack link is matched with the time attack link;

[0028] When matching, the original car attack link model is determined to be the target car attack link model;

[0029] When there is a mismatch, it is determined that the original car attack link model training has failed.

[0030] In a possible implementation, when the current vulnerability is acquired, determining the vulnerability-affected component and the attack link according to the component where the current vulnerability is located, the method further includes:

[0031] When there are multiple attack links, determine the target attack link based on the log data.

[0032] In a second aspect, the present invention provides a vulnerability tracing device based on an automobile attack link, the device comprising:

[0033] An acquisition unit, the acquisition unit is used to acquire vulnerability information from multiple sources; the multiple sources include vulnerability reports, attack cases, and security research papers; the vulnerability information includes the vulnerability type, attack method, and affected components of each vulnerability;

[0034] A processing unit, the processing unit is used to process the vulnerability information according to a machine learning algorithm to obtain an original automobile attack link model;

[0035] A verification unit, the verification unit is used to verify the original car attack link model to obtain a target car attack link model; the target car attack link model includes the component where the vulnerability is located, the attack method, the vulnerability-affected component and the attack link;

[0036] The first determination unit is used to determine the vulnerability-affected components and attack links according to the components where the current vulnerability is located, the attack method and the target vehicle attack link model when the current vulnerability is obtained.

[0037] In a possible implementation manner, the apparatus further includes: a second determining unit;

[0038] The second determination unit is used to determine a target attack link according to log data when there are multiple attack links.

[0039] In a third aspect, the present invention provides a computer server, comprising: a memory, a processor and a transceiver;

[0040] The processor is used to couple with the memory, read and execute instructions in the memory, so as to implement the vulnerability tracing method based on the automobile attack link according to any one of the first aspects;

[0041] The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

[0042] In a fourth aspect, the present invention provides a chip system, including a processor, the processor is coupled to a memory, the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor, the vulnerability tracing method based on the automobile attack link described in any one of the first aspects is implemented.

[0043] In a fifth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and the computer program is executed by a processor to implement the vulnerability tracing method based on an automobile attack link as described in any one of claims 1 to 5.

[0044] By applying the vulnerability tracing method based on the automobile attack link provided by the present invention, through fine-grained attack link modeling, it is possible to more accurately describe the correlation between attack behaviors and vulnerabilities in the automobile system, reduce dependence on expert experience and manual analysis, improve the efficiency of the tracing process, and automatically locate the attack link, thereby improving the accuracy of attack link positioning. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a flow chart of a vulnerability tracing method based on an automobile attack link provided in the first embodiment of the present invention;

[0046] Figure 2 is a flowchart of step 120;

[0047] Figure 3 is a flowchart of step 130;

[0048] Figure 4 A second flow chart of a vulnerability tracing method based on an automobile attack link provided in the first embodiment of the present invention;

[0049] Figure 5 This is a schematic diagram of the structure of a vulnerability tracing device based on an automobile attack link provided in the second embodiment of the present invention;

[0050] Figure 6 The second structural diagram of the vulnerability tracing device based on the automobile attack link provided in the second embodiment of the present invention;

[0051] Figure 7 A schematic diagram of the computer server structure provided in Embodiment 3 of the present invention;

[0052] Figure 8 A schematic diagram of the chip system structure provided in the fourth embodiment of the present invention;

[0053] Fig. 9 This is a schematic diagram of the chip system structure provided in Example 5 of the present invention. DETAILED DESCRIPTION

[0054] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0055] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0056] Embodiment 1

[0057] Embodiment 1 of the present invention provides a vulnerability tracing method based on a car attack link. The execution subject of this application is a server, or a processor of the vehicle itself, such as a processor of an autonomous driving vehicle, or other devices with computing and processing functions, such as Figure 1 As shown, the method comprises the following steps:

[0058] Step 110, obtaining vulnerability information from multiple sources.

[0059] Among them, the multiple sources include vulnerability reports, attack cases, and security research papers; the vulnerability information includes the vulnerability type, attack method and affected components of each vulnerability; among them, a vulnerability is a defect in the specific implementation of hardware, software, protocol or system security policy, which can enable attackers to access or damage the system without authorization; a vulnerability report is a vulnerability reported in the form of a report; an attack case refers to an instance of an attack that has occurred; a security research paper refers to papers and literature on security; this application collects automobile vulnerability information from multiple sources, thereby ensuring that the source of vulnerability information is wide, and correspondingly improving the accuracy of the subsequent training model.

[0060] Vulnerability types include: information leakage vulnerabilities, remote code execution vulnerabilities, and privilege escalation vulnerabilities; information leakage vulnerabilities refer to intentional or unintentional disclosure of useful information to users, and attackers can often use this information to attack vehicles; remote code execution vulnerabilities are caused by developers not filtering the executable special function entries in the code when writing source code. Without specifying an absolute path, users submit execution commands through the browser. Since the server does not filter the execution function, the command is executed without specifying an absolute path, which may allow attackers to execute maliciously constructed code by changing $PATH or other aspects of the program execution environment; privilege escalation vulnerabilities are hackers who can enter a higher state after entering the target machine through some means.

[0061] The attack methods include remote code execution attack, CAN bus attack and relay attack; among them, remote code execution attack targets remote code execution vulnerability; CAN bus attack is an attack on the CAN bus; relay attack is an attack between two legitimate participants A and B, where the middleman C tampers with A's message and sends it to B or tampers with B's message and sends it to A. The affected components include: In-Vehicle Infotainment (IVI), Bluetooth key, Near Field Communication (NFC) key.

[0062] Step 120, processing the vulnerability information according to a machine learning algorithm to obtain an original automobile attack link model;

[0063] Specifically, Figure 2 As shown, step 120 includes:

[0064] Step 1201, determining the attack mode of each vulnerability, the component where the vulnerability is located, and at least one affected component affected by the vulnerability according to a clustering algorithm and an association rule mining algorithm;

[0065] Specifically, in step 110, a large amount of vulnerability information is obtained, and the vulnerability information is processed by a clustering algorithm and an association rule mining algorithm to determine the attack method of each vulnerability, the component where it is located, and each affected component affected by the vulnerability.

[0066] Step 1202, mapping each vulnerability with the ATT&CK knowledge base according to the ATT&CK knowledge base, and determining at least one attack link of the vulnerability;

[0067] Among them, the ATT&CK knowledge base stores multiple real attack events that occurred in reality. In the real attack events, the attack links of the vulnerabilities are included. The existing vulnerabilities in step 1201 can be mapped to their attack links. For vulnerabilities that are not in step 1201, their attack links can also be queried. The attack link of each vulnerability can be one or more. For example, the attack link of a vulnerability can be from AB or from CAB. For example, if the affected components collected are IVI and TBox, IVI can be associated with TBox, because the attacker may use IVI as a springboard to attack TBox. The attack link in this case is: USB access to the car computer => automatic playback of media files => triggering a file parsing vulnerability, causing the car computer to crash and shut down.

[0068] Step 1203 , after associating the attack mode of each vulnerability, the component where it is located, at least one affected component of the vulnerability, and at least one attack link of the vulnerability, an original automobile attack link model is obtained.

[0069] Specifically, the original automobile attack link model includes multiple vulnerabilities, the attack method of each vulnerability, the component where it is located, at least one affected component of the vulnerability, and at least one attack link of the vulnerability.

[0070] Step 130, verifying the original automobile attack link model to obtain a target automobile attack link model.

[0071] The target car attack link model includes the component where the vulnerability is located, the attack method, the vulnerability-affected component and the attack link.

[0072] Specifically, Figure 3 As shown, step 130 includes:

[0073] Step 1301, input any vulnerability information into the original automobile attack link model;

[0074] When the attack link is output, step 1303 is executed, and when the attack link cannot be output, step 1302 is executed.

[0075] Step 1302, when the attack link cannot be output, it is determined that the training of the original automobile attack link model has failed;

[0076] Among them, when it is determined that the original car attack link model training fails, the model is retrained.

[0077] Step 1303, when the attack link is output, the output attack link is matched with the time attack link;

[0078] When there is a match, step 1304 is executed, and when there is no match, step 1305 is executed.

[0079] Step 1304, when matching, determining the original car attack link model as the target car attack link model;

[0080] Among them, when matching, it means that the original car attack link model is trained successfully, and the original car attack link model can be used as the final target car attack link model.

[0081] Step 1305: When there is no match, it is determined that the original car attack link model training fails.

[0082] Among them, when it is determined that the original car attack link model training fails, the model is retrained.

[0083] Step 140, when the current vulnerability is obtained, the vulnerability-affected component and attack link are determined according to the component where the current vulnerability is located, the attack method and the target vehicle attack link model.

[0084] Specifically, all possible attack scenarios have been listed in the target car attack link model. The target car attack link model has learned all attack links. When an attack occurs, the component where the vulnerability is located and the attack method are input into the trained model, and the model will output possible attack links. The target car attack link model infers the attack link based on the component where the current vulnerability is located. For example, if the attack link is A—〉B—〉C, B—〉DE, and the attack method that occurs is B, then the target car attack link model can infer that C or D can be used to attack through B. Among them, B, C, D, and E can all be regarded as attack methods in different components.

[0085] Furthermore, the present application can model a vehicle, and after determining the attack link, visualize the attack link in the modeled vehicle. The vehicle modeling includes multiple components on the vehicle, so that it can visualize which component the attack starts from, which components it passes through, and which component is finally attacked, forming a visualized attack link, which is convenient for intuitive viewing of the attack link.

[0086] Furthermore, the attack link determined above is not unique, and further determination can be made in combination with log data. Figure 4 As shown, the application also includes the following steps:

[0087] Step 410: When there are multiple attack links, determine the target attack link according to the log data.

[0088] When a new vulnerability appears, the model will infer one or more possible attack paths based on its own understanding. At this time, when tracing the source, it is necessary to make a comprehensive judgment based on different types of logs. For example, an illegal file appears in TBox. There are many ways to achieve this effect, such as downloading directly from the cloud, or TBox opens ports 22 and 21, and the attacker transfers the file to TBox through the open port. At this time, it is necessary to combine the system log and network log of TBox to analyze and determine which method is used to transfer the file to TBox. If the connection behavior of port 22 appears in the log, it can be determined that the attacker accesses TBox through port 22 to transfer files to TBox.

[0089] Specifically, in one example, the attack links learned by the target car attack link model are A—〉C and B—〉C. If there is a component similar to C at this time, the target car attack link model will infer that the attack may start from A or B. In order to determine whether it is A or B, the log data of A and B can be used to determine which component the attack started from. For example, if a timestamp in the log data of A corresponds to abnormal behavior, it can be determined that A—〉C is the target attack link, thereby further improving the accuracy of locating the attack link.

[0090] By applying the vulnerability tracing method based on the automobile attack link provided by the present invention, through fine-grained attack link modeling, it is possible to more accurately describe the correlation between attack behaviors and vulnerabilities in the automobile system, reduce dependence on expert experience and manual analysis, improve the efficiency of the tracing process, and automatically locate the attack link, thereby improving the accuracy of attack link positioning.

[0091] Embodiment 2

[0092] Embodiment 2 of the present invention provides a vulnerability tracing device based on an automobile attack link, such as Figure 5As shown, the device includes: an acquisition unit 510, a processing unit 520, a verification unit 530, and a first determination unit 540.

[0093] The acquisition unit 510 is used to acquire vulnerability information from multiple sources; the multiple sources include vulnerability reports, attack cases, and security research papers; the vulnerability information includes the vulnerability type, attack method, and affected component of each vulnerability;

[0094] The processing unit 520 is used to process the vulnerability information according to the machine learning algorithm to obtain the original automobile attack link model;

[0095] The verification unit 530 is used to verify the original car attack link model to obtain the target car attack link model; the target car attack link model includes the component where the vulnerability is located, the attack method, the vulnerability-affected component and the attack link;

[0096] The first determination unit 540 is used to determine the vulnerability-affected component and the attack link according to the component where the current vulnerability is located, the attack method and the target vehicle attack link model when the current vulnerability is obtained.

[0097] Furthermore, the vulnerability types include: information leakage vulnerability, remote code execution vulnerability and privilege escalation vulnerability; the attack methods include remote code execution attack, CAN bus attack and relay attack; the affected components include: in-vehicle infotainment system IVI, Bluetooth key, near-field communication NFC key.

[0098] Furthermore, the processing unit 520 processes the vulnerability information according to the machine learning algorithm to obtain the original automobile attack link model, which specifically includes: determining the attack mode of each vulnerability, the component where it is located, and at least one affected component affected by the vulnerability according to the clustering algorithm and the association rule mining algorithm; mapping each vulnerability with the ATT&CK knowledge base according to the ATT&CK knowledge base to determine at least one attack link of the vulnerability; associating the attack mode of each vulnerability, the component where it is located, at least one affected component of the vulnerability, and at least one attack link of the vulnerability to obtain the original automobile attack link model.

[0099] Further, the verification unit 530 verifies the original automobile attack link model to obtain the target automobile attack link model, which specifically includes: inputting any vulnerability information into the original automobile attack link model; when the attack link cannot be output, determining that the original automobile attack link model training has failed; when the attack link is output, matching the output attack link with the time attack link; when matching, determining that the original automobile attack link model is the target automobile attack link model; when not matching, determining that the original automobile attack link model training has failed.

[0100] Combination Figure 5In one possible implementation, Figure 6 As shown, the device further includes: a second determining unit 610.

[0101] The second determination unit is used to determine a target attack link according to log data when there are multiple attack links.

[0102] Embodiment 3

[0103] Embodiment 3 of the present invention provides a computer server, such as Figure 7 As shown, it includes: a memory, a processor and a transceiver;

[0104] The processor is used to couple with the memory, read and execute instructions in the memory, so as to implement any one of the vulnerability tracing methods based on the automobile attack link provided in the first embodiment above;

[0105] The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

[0106] Embodiment 4

[0107] Embodiment 4 of the present invention provides a chip system, such as Figure 8 As shown, it includes a processor, a coupling between the processor and a memory, the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor, any vulnerability tracing method based on the automobile attack link provided in Example 1 is implemented.

[0108] Embodiment 5

[0109] Embodiment 5 of the present invention provides a computer-readable storage medium, such as Fig. 9 As shown, it includes a program or instruction. When the program or instruction is run on a computer, any vulnerability tracing method based on an automobile attack link provided in Example 1 is implemented.

[0110] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0111] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0112] The above specific implementation methods further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A vulnerability tracing method based on an automobile attack link, characterized in that: The method comprises: Obtain vulnerability information from multiple sources; the multiple sources include vulnerability reports, attack cases, and security research papers; the vulnerability information includes the vulnerability type, attack method, and affected components of each vulnerability; Processing the vulnerability information according to a machine learning algorithm to obtain an original automobile attack link model; The original car attack link model is verified to obtain a target car attack link model; the target car attack link model includes the component where the vulnerability is located, the attack method, the vulnerability-affected component and the attack link; When the current vulnerability is obtained, the affected components and attack links are determined according to the component where the current vulnerability is located, the attack method, and the target vehicle attack link model; The method of processing the vulnerability information according to the machine learning algorithm to obtain the original automobile attack link model specifically includes: Determine the attack mode of each vulnerability, the component where it is located, and at least one affected component affected by the vulnerability according to the clustering algorithm and the association rule mining algorithm; According to the ATT&CK knowledge base, map each vulnerability to the ATT&CK knowledge base to determine at least one attack link of the vulnerability; After associating the attack mode of each vulnerability, the component where it is located, at least one affected component of the vulnerability, and at least one attack link of the vulnerability, an original automobile attack link model is obtained; The verifying of the original car attack link model to obtain the target car attack link model specifically includes: Input any vulnerability information into the original automobile attack link model; When the attack link cannot be output, it is determined that the training of the original car attack link model has failed; When the attack link is output, the output attack link is matched with the time attack link; When matching, the original car attack link model is determined to be the target car attack link model; When there is a mismatch, it is determined that the original car attack link model training has failed.

2. The method according to claim 1, characterized in that The vulnerability types include: information leakage vulnerability, remote code execution vulnerability and privilege escalation vulnerability; the attack methods include remote code execution attack, CAN bus attack and relay attack; the affected components include: in-vehicle infotainment system IVI, Bluetooth key, near-field communication NFC key.

3. The method according to claim 1, characterized in that When the current vulnerability is obtained, determining the vulnerability-affected component and the attack link according to the component where the current vulnerability is located, the method further includes: When there are multiple attack links, determine the target attack link based on the log data.

4. A vulnerability tracing device based on an automobile attack link, characterized in that: The device comprises: An acquisition unit, the acquisition unit is used to acquire vulnerability information from multiple sources; the multiple sources include vulnerability reports, attack cases, and security research papers; the vulnerability information includes the vulnerability type, attack method, and affected components of each vulnerability; A processing unit, the processing unit is used to process the vulnerability information according to a machine learning algorithm to obtain an original automobile attack link model; A verification unit, the verification unit is used to verify the original car attack link model to obtain a target car attack link model; the target car attack link model includes the component where the vulnerability is located, the attack method, the vulnerability-affected component and the attack link; A first determination unit, the first determination unit is used to determine the vulnerability-affected component and the attack link according to the component where the current vulnerability is located, the attack method and the target vehicle attack link model when the current vulnerability is obtained; The processing unit processes the vulnerability information according to the machine learning algorithm to obtain the original automobile attack link model, which specifically includes: Determine the attack mode of each vulnerability, the component where it is located, and at least one affected component affected by the vulnerability according to the clustering algorithm and the association rule mining algorithm; According to the ATT&CK knowledge base, map each vulnerability to the ATT&CK knowledge base to determine at least one attack link of the vulnerability; After associating the attack mode of each vulnerability, the component where it is located, at least one affected component of the vulnerability, and at least one attack link of the vulnerability, an original automobile attack link model is obtained; The verification unit verifies the original car attack link model to obtain the target car attack link model, which specifically includes: Input any vulnerability information into the original automobile attack link model; When the attack link cannot be output, it is determined that the training of the original car attack link model has failed; When the attack link is output, the output attack link is matched with the time attack link; When matching, the original car attack link model is determined to be the target car attack link model; When there is a mismatch, it is determined that the original car attack link model training has failed.

5. The device according to claim 4, characterized in that The device further includes: a second determining unit; The second determination unit is used to determine a target attack link according to log data when there are multiple attack links.

6. A computer server, characterized in that: include: memory, processors, and transceivers; The processor is used to couple with the memory, read and execute instructions in the memory, so as to implement the vulnerability tracing method based on the automobile attack link according to any one of claims 1 to 3; The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

7. A chip system, characterized in that: It includes a processor, the processor is coupled to a memory, the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor, the vulnerability tracing method based on the automobile attack link according to any one of claims 1 to 3 is implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the vulnerability tracing method based on the automobile attack link described in any one of claims 1 to 3.

Images