Method, device, processor and computer device for CAN message security detection

Abstract

The application discloses a kind of method, device, processor and computer equipment for CAN message security detection, belong to vehicle networking security detection technical field.The method comprises: obtaining the current timestamp of current periodic CAN message and the last timestamp of last periodic CAN message;According to current timestamp and last timestamp, the message time interval of current periodic CAN message and last periodic CAN message is determined;In the case where message time interval does not satisfy preset message time interval range, the event information corresponding to current periodic CAN message is obtained;According to event information, the alarm suppression strategy corresponding to current periodic CAN message is determined, to execute alarm suppression strategy.The application can reduce the possibility of false alarm due to normal mechanism on CAN bus.

Description

Technical Field

[0001] This application relates to the field of vehicle network security detection technology, specifically to a method, apparatus, processor, and computer equipment for CAN message security detection. Background Technology

[0002] Currently, automobiles are widely automated, equipped with a range of sensors and computing systems. There are over 100 vehicle controllers, and this number is expected to increase in the future. These controllers are distributed around the vehicle and communicate with each other via in-vehicle communication networks, such as Controller Area Network (CAN). As the most common in-vehicle communication protocol, the CAN bus offers advantages such as low cost, immunity to electrical interference, self-diagnostics, and error correction. However, despite these advantages, the increasing inter-vehicle and intra-vehicle communication makes the CAN bus vulnerable to network attacks.

[0003] Existing technologies typically detect anomalies in periodic messages by using the difference between the message period and the message timestamp. However, some normal scenarios on the CAN bus can also cause the time interval between consecutive CAN messages to shorten or lengthen. In such cases, existing CAN message detection methods are prone to errors in anomaly detection results, leading to a high false alarm rate. Summary of the Invention

[0004] The purpose of this application is to provide a method, apparatus, processor, and computer device for CAN message security detection, in order to solve the problem of high false alarm rate in existing CAN message detection methods.

[0005] To achieve the above objectives, a first aspect of this application provides a method for CAN message security detection, wherein the CAN message includes periodic CAN messages, and the method includes:

[0006] Get the current timestamp of the current periodic CAN message and the previous timestamp of the previous periodic CAN message;

[0007] The message time interval between the current periodic CAN message and the previous periodic CAN message is determined based on the current timestamp and the previous timestamp.

[0008] If the message time interval does not meet the preset message time interval range, obtain the event information corresponding to the current periodic CAN message;

[0009] The alarm suppression policy corresponding to the current periodic CAN message is determined based on the event information, and then the alarm suppression policy is executed.

[0010] In this embodiment, the event information includes a frame type, which includes a remote frame type. The alarm suppression strategy corresponding to the current periodic CAN message is determined based on the event information and executed. The alarm suppression strategy includes: when the frame type is a remote frame type, determining whether the message time interval is less than the lower limit threshold of a preset message time interval range; and when the message time interval is less than the lower limit threshold of the preset message time interval range, suppressing the transmission of alarm information related to the current periodic CAN message.

[0011] In this embodiment, the event information includes a frame type, which includes an error frame type. The alarm suppression strategy corresponding to the current periodic CAN message is determined based on the event information, and the alarm suppression strategy is executed. This includes: determining a preset alarm suppression time period when the frame type is an error frame type; and suppressing the transmission of alarm information related to the current periodic CAN message within the preset alarm suppression time period.

[0012] In this embodiment, the event information includes a frame type, which includes an overload frame type. The alarm suppression strategy corresponding to the current periodic CAN message is determined based on the event information and executed. The alarm suppression strategy includes: when the frame type is an overload frame type, determining whether the message time interval is greater than the upper limit threshold of the preset message time interval range; and when the message time interval is greater than the upper limit threshold of the preset message time interval range, suppressing the transmission of alarm information related to the current periodic CAN message.

[0013] In this embodiment of the application, the method further includes: determining whether communication control service information has been obtained; if communication control service information has been obtained, determining the execution action state and the target microcontroller corresponding to the execution action state based on the communication control service information; if the execution action state is enabled, obtaining the timestamp information of the periodic CAN message sent by the target microcontroller corresponding to the execution action state, so as to determine whether the preset time interval range is met based on the timestamp information.

[0014] In this embodiment of the application, obtaining the current periodic CAN message and / or the previous periodic CAN message includes: obtaining a database file; determining the periodic CAN message identifier of the current periodic CAN message and / or the previous periodic CAN message based on the rule information in the database file; and obtaining the current periodic CAN message and / or the previous periodic CAN message according to the periodic CAN message identifier.

[0015] A second aspect of this application provides an apparatus for CAN message security detection, comprising: a timestamp acquisition module for acquiring the current timestamp of the current periodic CAN message and the previous timestamp of the previous periodic CAN message; a time interval determination module for determining the message time interval between the current periodic CAN message and the previous periodic CAN message based on the current timestamp and the previous timestamp; an event information acquisition module for acquiring event information corresponding to the current periodic CAN message when the message time interval does not meet a preset message time interval range; and an alarm suppression strategy execution module for determining an alarm suppression strategy corresponding to the current periodic CAN message based on the event information, and executing the alarm suppression strategy.

[0016] A third aspect of this application provides a processor configured to perform the above-described method for CAN message security detection.

[0017] A fourth aspect of this application provides a computer device, including the aforementioned apparatus for CAN message security detection or the aforementioned processor.

[0018] A fifth aspect of this application provides a machine-readable storage medium storing instructions that cause a machine to perform the aforementioned method for CAN message security detection.

[0019] The above technical solution obtains the current timestamp of the current periodic CAN message and the previous timestamp of the previous periodic CAN message, and then determines the message time interval between the current and previous periodic CAN messages based on the current and previous timestamps. If the message time interval does not meet the preset message time interval range, the event information corresponding to the current periodic CAN message is obtained, and an alarm suppression strategy corresponding to the current periodic CAN message is determined and executed based on the event information. This application reduces the possibility of false alarms caused by normal mechanisms on the CAN bus by suppressing the transmission of alarm information based on the obtained event information corresponding to the current periodic CAN message when the message time interval of periodic CAN messages is abnormal.

[0020] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0021] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings:

[0022] Figure 1A flowchart illustrating a method for CAN message security detection according to an embodiment of this application is shown schematically.

[0023] Figure 2 The illustration shows a schematic diagram of a remote frame according to an embodiment of this application;

[0024] Figure 3 The illustration shows a schematic diagram of an overload frame according to an embodiment of this application;

[0025] Figure 4 The diagram schematically illustrates a structural block diagram of an apparatus for CAN message security detection according to an embodiment of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0027] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0028] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0029] Figure 1 A flowchart illustrating a method for CAN message security detection according to an embodiment of this application is shown schematically. Figure 1As shown in the figure, this application provides a method for CAN message security detection. The CAN message includes periodic CAN messages. Taking the application of this method to a processor as an example, the method may include the following steps:

[0030] Step S101: Obtain the current timestamp of the current periodic CAN message and the previous timestamp of the previous periodic CAN message.

[0031] Step S102: Determine the message time interval between the current periodic CAN message and the previous periodic CAN message based on the current timestamp and the previous timestamp.

[0032] Step S103: If the message time interval does not meet the preset message time interval range, obtain the event information corresponding to the current periodic CAN message.

[0033] Step S104: Determine the alarm suppression policy corresponding to the current periodic CAN message based on the event information, and execute the alarm suppression policy.

[0034] CAN messages include periodic CAN messages and event-based CAN messages. Periodic CAN messages are messages sent cyclically. For periodic CAN messages, existing technology first analyzes the vehicle's database file to identify the periodic CAN messages present on the CAN bus. The identifier of the periodic CAN message and its theoretical period value are then mapped as the processor's detection rule. For example, if the database file describes the theoretical period value of a periodic CAN message with CAN identifier 'a' as b milliseconds, the corresponding detection rule is that the timestamp difference between two consecutive periodic CAN messages with CAN identifier 'a' should be between (b-Δt) milliseconds and (b+Δt) milliseconds, where Δt is the allowable error, typically not exceeding half the theoretical period value. The processor then monitors the periodic CAN messages on the CAN bus in real time. When it detects a periodic CAN message with CAN identifier 'a', it records the timestamp of the current periodic CAN message and subtracts it from the timestamp of the previous periodic CAN message with CAN identifier 'a'. If the timestamp difference is not within the range of (b-Δt) milliseconds to (b+Δt) milliseconds, it is judged as an abnormal message and an alarm is triggered. However, existing technology does not consider some normal mechanisms on the CAN bus that can cause CAN messages to be sent delayed, sent immediately, or not sent for a period of time, such as remote frames, error frames, overload frames, and diagnostic service protocols. These scenarios can cause the time interval of continuous periodic CAN messages to shorten or lengthen, thus causing the processor to perform alarm operations. These alarm operations are all false alarms, yet existing technology does not provide special handling for these scenarios.

[0035] To address the aforementioned issues, and based on the characteristics of these scenarios, this application embodiment processes the alarm operation performed after detecting periodic CAN messages to reduce the false alarm rate. In this application embodiment, after the processor receives a periodic CAN message through the CAN message transceiver, the processor can determine the current timestamp of the current periodic CAN message and the previous timestamp of the previous periodic CAN message, and determine the message time interval between the current periodic CAN message and the previous periodic CAN message based on the current timestamp and the previous timestamp, that is, by subtracting the previous timestamp from the current timestamp to obtain the message time interval.

[0036] Furthermore, the processor can parse the database file to obtain microcontroller information on the CAN bus and the preset message time interval range corresponding to the periodic CAN message identified by each CAN message identifier. Thus, the processor can determine the preset message time interval range corresponding to the current periodic CAN message. Next, the processor can determine whether the message time interval between the current periodic CAN message and the previous periodic CAN message meets the preset message time interval range corresponding to the current periodic CAN message. When the message time interval meets the preset message time interval range corresponding to the current periodic CAN message, the processor can determine that the transmission cycle of the current periodic CAN message is normal, and no further judgment process is needed. When the message time interval does not meet the preset message time interval range, it can be determined that the transmission cycle of the current periodic CAN message is abnormal. At this time, the processor needs to further determine whether the event information corresponding to the current periodic CAN message has been obtained to determine whether the transmission of alarm information needs to be suppressed. Event information refers to the information sent to the processor after the driver layer encapsulates the frame information by calling the hook function. If the processor obtains the event information corresponding to the current periodic CAN message, the processor can determine the alarm suppression strategy corresponding to the current periodic CAN message based on the event information, and then execute the alarm suppression strategy to suppress the transmission of alarm information and reduce the false alarm rate in the process of detecting periodic CAN messages.

[0037] Furthermore, the methods for CAN message security detection can be compiled into a static library, providing two callable interfaces: a detection rule address interface and an information interface. The detection rule address interface can be used to obtain the address of rule information from the database file. The information interface can be used to implement information exchange. By integrating the static library with the vehicle gateway code and then burning it into the vehicle gateway device, as well as burning the database file into the vehicle gateway device, periodic CAN messages can be detected after the vehicle gateway device is running, reducing the false alarm rate of periodic CAN message detection.

[0038] The above technical solution obtains the current timestamp of the current periodic CAN message and the previous timestamp of the previous periodic CAN message, and then determines the message time interval between the current and previous periodic CAN messages based on the current and previous timestamps. If the message time interval does not meet the preset message time interval range, the event information corresponding to the current periodic CAN message is obtained, and an alarm suppression strategy corresponding to the current periodic CAN message is determined and executed based on the event information. This application reduces the possibility of false alarms caused by normal mechanisms on the CAN bus by suppressing the transmission of alarm information based on the obtained event information corresponding to the current periodic CAN message when the message time interval of periodic CAN messages is abnormal.

[0039] In this embodiment, the event information includes a frame type, which includes a remote frame type. The alarm suppression strategy corresponding to the current periodic CAN message is determined based on the event information and executed. This can include: when the frame type is a remote frame type, determining whether the message time interval is less than the lower limit threshold of a preset message time interval range; and when the message time interval is less than the lower limit threshold of the preset message time interval range, suppressing the transmission of alarm information related to the current periodic CAN message.

[0040] In this embodiment, a remote frame is a frame used by the receiving unit to request data transmission from the sending unit. It consists of six segments: frame start, arbitration segment, control segment, Cyclic Redundancy Check (CRC) segment, Acknowledge (ACK) segment, and frame end. The frame start of a remote frame is a dominant level and can be used to identify the beginning of the frame. The arbitration segment indicates the priority of the frame and can request a data frame with the same identifier. The control segment indicates the number of bytes of data and reserved bits. The CRC segment checks for transmission errors in the frame. The ACK segment acknowledges normal reception. The frame end indicates the end of the remote frame. By determining the frame structure, the processor can determine the corresponding frame type.

[0041] The remote frame includes the CAN message identifier that the microcontroller, acting as the receiving unit, expects to receive. Figure 2 The illustration schematically depicts a principle diagram of a remote frame according to an embodiment of this application. For example... Figure 2As shown, after receiving a remote frame and extracting the CAN message identifier from it, the microcontroller, acting as the transmitting unit, immediately assembles the CAN message corresponding to the CAN message identifier and sends it to the CAN bus, i.e., inserts a message. Therefore, a remote frame causes the message time interval between two consecutive periodic CAN messages to decrease. Based on the aforementioned characteristics of a remote frame, when the frame type is remote, the processor can determine whether the message time interval is less than the lower limit of a preset message time interval range. If the message time interval is less than the lower limit, the transmission of alarm information related to the current periodic CAN message is suppressed. If the message time interval is greater than the upper limit, the transmission of alarm information related to the current periodic CAN message is not suppressed, thereby reducing the possibility of false alarms due to remote frames.

[0042] In this embodiment, the event information includes a frame type, which includes an error frame type. The alarm suppression strategy corresponding to the current periodic CAN message is determined based on the event information and executed. This can include: determining a preset alarm suppression time period when the frame type is an error frame type; and suppressing the transmission of alarm information related to the current periodic CAN message within the preset alarm suppression time period.

[0043] In this embodiment, when the microcontroller receives and sends CAN messages, if it detects an error, it will send an error frame to notify each node that an error has occurred. According to the CAN protocol, the microcontroller has three states when an error occurs: active error state, passive error state, and offline state. In the active and passive error states, the microcontroller can communicate normally, but the sent and received CAN messages may not be correct. When the number of error messages reaches a preset number, the microcontroller will enter the offline state and stop sending CAN messages. The error frame consists of an error flag and an error delimiter. In the active error state, the error flag has 6 dominant bits (6 high levels). In the passive error state, the error flag has 6 recessive bits (6 low levels). The error delimiter consists of 8 recessive bits (8 low levels). By determining the frame structure, the processor can determine the corresponding frame type.

[0044] Therefore, based on the aforementioned characteristics of erroneous frames, when the frame type is an erroneous frame, the processor can determine a preset alarm suppression period. The preset alarm suppression period can be determined based on the duration of CAN messages that cannot be sent or received normally, as reported by the microcontroller. In this way, within the preset alarm suppression period, the processor can suppress the transmission of alarm information related to the current periodic CAN message, thereby reducing the possibility of false alarms due to erroneous frames.

[0045] In this embodiment, the event information includes a frame type, which includes an overload frame type. The alarm suppression strategy corresponding to the current periodic CAN message is determined based on the event information and executed. This can include: if the frame type is an overload frame type, determining whether the message time interval is greater than the upper limit threshold of a preset message time interval range; if the message time interval is greater than the upper limit threshold of the preset message time interval range, suppressing the transmission of alarm information related to the current periodic CAN message.

[0046] In the embodiments of this application, an overload frame is a frame in which the receiving unit reports to other nodes on the CAN bus that its receiving capacity has reached its limit. Figure 3 The illustration schematically depicts a principle diagram of an overload frame according to an embodiment of this application. For example... Figure 3 As shown, an overload frame can disrupt the CAN message sent by the transmitting unit, causing it to retransmit the failed CAN message after a preset delay, i.e., a transmission failure message. This results in an extended message interval. An overload frame consists of an overload flag and an overload delimiter. The overload flag has 6 dominant bits, and the overload delimiter has 8 recessive bits. By determining the frame structure, the processor can determine the corresponding frame type.

[0047] Therefore, based on the aforementioned characteristics of overload frames, when the frame type is determined to be an overload frame, the processor can determine whether the message time interval exceeds the upper threshold of the preset message time interval range. If the message time interval exceeds the upper threshold of the preset message time interval range, the transmission of alarm information related to the current periodic CAN message is suppressed, reducing the possibility of false alarms caused by overload frames. If the message time interval is less than the lower threshold of the preset message time interval range, it is not necessary to suppress the transmission of alarm information related to the current periodic CAN message.

[0048] In this embodiment of the application, the method may further include: determining whether communication control service information has been obtained; if communication control service information has been obtained, determining the execution action state and the target microcontroller corresponding to the execution action state based on the communication control service information; if the execution action state is enabled, obtaining the timestamp information of the periodic CAN message sent by the target microcontroller corresponding to the execution action state, so as to determine whether the preset time interval range is met based on the timestamp information.

[0049] In this embodiment, the communication control service can control the sending and receiving of CAN messages. The communication control service can be a diagnostic service protocol. When improved transmission efficiency is required, the transmission of some CAN messages can be disabled and then re-enabled via the communication control service after data transmission is complete. The communication control service message is transmitted via CAN data frames, and it only specifies the format of the data portion of the CAN data frame; the first four bits of the first byte in the data field are all 0. Furthermore, the CAN message identifier of the communication control service message is 0x700 or higher. The message format specified by the communication control service includes a service identifier, which can be used to identify the service type; it is typically 0x28. Therefore, based on the characteristics of the communication control service, the processor can determine whether it has obtained a communication control service message from the CAN bus by examining the first byte in the data field, the CAN message identifier, and the service identifier. If the communication control service message is obtained, the processor can obtain communication control service information by parsing it.

[0050] In this way, upon obtaining the communication control service information, the processor can determine whether it needs to detect periodic CAN messages on the CAN bus. The communication control service information includes the execution action status and the target microcontroller corresponding to that status. The execution action status can be on or off. When the execution action status is on, the target microcontroller's communication service is enabled, and the processor needs to detect the periodic CAN messages sent by the target microcontroller based on the timestamp information. Specifically, the processor can obtain the current timestamp of the current periodic CAN message sent by the target microcontroller, and the previous timestamp of the previous periodic CAN message sent by the target microcontroller, thereby determining whether the message time interval of the current periodic CAN message meets the preset time interval range, and thus determining whether an alarm message needs to be sent. When the execution action status is off, the target microcontroller's communication service is off, and the target microcontroller does not receive or send periodic CAN messages; therefore, the processor does not need to perform detection. This reduces resource consumption and improves the efficiency of periodic CAN message detection.

[0051] In this embodiment of the application, obtaining the current periodic CAN message and / or the previous periodic CAN message may include: obtaining a database file; determining the periodic CAN message identifier of the current periodic CAN message and / or the previous periodic CAN message based on the rule information in the database file; and obtaining the current periodic CAN message and / or the previous periodic CAN message according to the periodic CAN message identifier.

[0052] In this embodiment, the processor can acquire a database file. The database file includes rule information, namely microcontroller information on the CAN bus and the periodic CAN identifier of the current periodic CAN message and / or the previous periodic CAN message. Using the periodic CAN identifier, the processor can obtain the current periodic CAN message and / or the previous periodic CAN message from the CAN messages on the CAN bus.

[0053] In summary, the technical solution provided in this application has the following advantages compared with the prior art:

[0054] For periodic CAN messages where the message interval is abnormal due to non-attack events, by increasing the monitoring of remote frames, overload frames, error frames, and communication control service information, the corresponding alarm suppression strategy can be determined to suppress the processor's alarm operations on periodic CAN messages. This effectively reduces alarm information generated by the processor due to non-human attacks on the CAN bus, allowing safety officers to eliminate interference from such alarm information when analyzing alarm logs.

[0055] This application also provides a processor configured to perform the above-described method for CAN message security detection.

[0056] Figure 4 This schematically illustrates a structural block diagram of an apparatus for CAN message security detection according to an embodiment of this application. Figure 4 As shown in the illustration, this application also provides an apparatus for CAN message security detection, comprising:

[0057] The timestamp acquisition module 410 is used to acquire the current timestamp of the current periodic CAN message and the previous timestamp of the previous periodic CAN message.

[0058] The time interval determination module 420 is used to determine the time interval between the current periodic CAN message and the previous periodic CAN message based on the current timestamp and the previous timestamp.

[0059] The event information acquisition module 430 is used to acquire the event information corresponding to the current periodic CAN message when the message time interval does not meet the preset message time interval range.

[0060] The alarm suppression policy execution module 440 is used to determine the alarm suppression policy corresponding to the current periodic CAN message based on the event information, and to execute the alarm suppression policy.

[0061] In one embodiment, the alarm suppression policy execution module 440 is further configured to: determine whether the message time interval is less than the lower limit threshold of the preset message time interval range when the frame type is a remote frame type; and suppress the transmission of alarm information related to the current periodic CAN message when the message time interval is less than the lower limit threshold of the preset message time interval range.

[0062] In one embodiment, the alarm suppression policy execution module 440 is further configured to: determine a preset alarm suppression time period when the frame type is an error frame type; and suppress the transmission of alarm information related to the current periodic CAN message within the preset alarm suppression time period.

[0063] In one embodiment, the alarm suppression strategy execution module 440 is further configured to: determine whether the message time interval is greater than the upper limit threshold of the preset message time interval range when the frame type is an overload frame type; and suppress the transmission of alarm information related to the current periodic CAN message when the message time interval is greater than the upper limit threshold of the preset message time interval range.

[0064] In one embodiment, the device for CAN message security detection further includes a communication control module, configured to: determine whether communication control service information has been obtained; if communication control service information has been obtained, determine the execution action state and the target microcontroller corresponding to the execution action state based on the communication control service information; if the execution action state is enabled, obtain the timestamp information of the periodic CAN message sent by the target microcontroller corresponding to the execution action state, so as to determine whether the preset time interval range is met based on the timestamp information.

[0065] In one embodiment, the apparatus for CAN message security detection further includes a periodic CAN message acquisition module, configured to: acquire a database file; determine the periodic CAN message identifier of the current periodic CAN message and / or the previous periodic CAN message based on the rule information in the database file; and acquire the current periodic CAN message and / or the previous periodic CAN message according to the periodic CAN message identifier.

[0066] The above technical solution obtains the current timestamp of the current periodic CAN message and the previous timestamp of the previous periodic CAN message, and then determines the message time interval between the current and previous periodic CAN messages based on the current and previous timestamps. If the message time interval does not meet the preset message time interval range, the event information corresponding to the current periodic CAN message is obtained, and an alarm suppression strategy corresponding to the current periodic CAN message is determined and executed based on the event information. This application reduces the possibility of false alarms caused by normal mechanisms on the CAN bus by suppressing the transmission of alarm information based on the obtained event information corresponding to the current periodic CAN message when the message time interval of periodic CAN messages is abnormal.

[0067] This application also provides a computer device, including the above-described apparatus for CAN message security detection or the above-described processor.

[0068] This application also provides a machine-readable storage medium storing instructions that cause a machine to perform the above-described method for CAN message security detection.

[0069] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0070] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0071] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0072] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0073] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0074] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0075] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0076] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0077] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for CAN message security detection, characterized in that, The CAN message includes periodic CAN messages, and the method includes: Get the current timestamp of the current periodic CAN message and the previous timestamp of the previous periodic CAN message; The message time interval between the current periodic CAN message and the previous periodic CAN message is determined based on the current timestamp and the previous timestamp. If the message time interval does not meet the preset message time interval range, obtain the event information corresponding to the current periodic CAN message; The alarm suppression policy corresponding to the current periodic CAN message is determined based on the event information, and the alarm suppression policy is executed. The event information includes a frame type, which includes a remote frame type. Determining the alarm suppression strategy corresponding to the current periodic CAN message based on the event information, and executing the alarm suppression strategy, includes: when the frame type is a remote frame type, determining whether the message time interval is less than a lower threshold of a preset message time interval range; and when the message time interval is less than the lower threshold of the preset message time interval range, suppressing the transmission of alarm information related to the current periodic CAN message. The frame type also includes an error frame type. The step of determining the alarm suppression strategy corresponding to the current periodic CAN message based on the event information and executing the alarm suppression strategy includes: when the frame type is an error frame type, determining a preset alarm suppression time period; and suppressing the transmission of alarm information related to the current periodic CAN message within the preset alarm suppression time period. The frame type also includes an overload frame type. The step of determining the alarm suppression strategy corresponding to the current periodic CAN message based on the event information and executing the alarm suppression strategy includes: when the frame type is an overload frame type, determining whether the message time interval is greater than the upper limit threshold of the preset message time interval range; when the message time interval is greater than the upper limit threshold of the preset message time interval range, suppressing the transmission of alarm information related to the current periodic CAN message.

2. The method of claim 1, wherein, The method further includes: Determine whether communication control service information has been obtained; Upon obtaining the communication control service information, the execution action state and the target microcontroller corresponding to the execution action state are determined based on the communication control service information. When the execution action state is enabled, the timestamp information of the periodic CAN message sent by the target microcontroller corresponding to the execution action state is obtained, so as to determine whether the preset message time interval range is met based on the timestamp information.

3. The method of claim 1, wherein, The acquisition of the current periodic CAN message and / or the previous periodic CAN message includes: Get the database file; Based on the rule information in the database file, determine the periodic CAN identifier of the current periodic CAN message and / or the previous periodic CAN message; Based on the CAN identifier of the periodic message, obtain the current periodic CAN message and / or the previous periodic CAN message.

4. A device for CAN message security detection, characterized in that, include: The timestamp acquisition module is used to obtain the current timestamp of the current periodic CAN message and the previous timestamp of the previous periodic CAN message. The time interval determination module is used to determine the message time interval between the current periodic CAN message and the previous periodic CAN message based on the current timestamp and the previous timestamp. The event information acquisition module is used to acquire the event information corresponding to the current periodic CAN message when the message time interval does not meet the preset message time interval range. An alarm suppression policy execution module is used to determine the alarm suppression policy corresponding to the current periodic CAN message based on the event information, and to execute the alarm suppression policy. The event information includes a frame type, which includes a remote frame type. Determining the alarm suppression strategy corresponding to the current periodic CAN message based on the event information, and executing the alarm suppression strategy, includes: when the frame type is a remote frame type, determining whether the message time interval is less than a lower threshold of a preset message time interval range; and when the message time interval is less than the lower threshold of the preset message time interval range, suppressing the transmission of alarm information related to the current periodic CAN message. The frame type also includes an error frame type. The step of determining the alarm suppression strategy corresponding to the current periodic CAN message based on the event information and executing the alarm suppression strategy includes: when the frame type is an error frame type, determining a preset alarm suppression time period; and suppressing the transmission of alarm information related to the current periodic CAN message within the preset alarm suppression time period. The frame type also includes an overload frame type. The step of determining the alarm suppression strategy corresponding to the current periodic CAN message based on the event information and executing the alarm suppression strategy includes: when the frame type is an overload frame type, determining whether the message time interval is greater than the upper limit threshold of the preset message time interval range; when the message time interval is greater than the upper limit threshold of the preset message time interval range, suppressing the transmission of alarm information related to the current periodic CAN message.

5. A processor, characterized in that, It is configured to perform the method for CAN message security detection according to any one of claims 1 to 3.

6. A computer device, characterized in that, Includes the apparatus for CAN message security detection as described in claim 4 or the processor as described in claim 5.

7. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions for causing the machine to perform the method for CAN message security detection according to any one of claims 1 to 3.

Images