CAN message detection method, detection device, processor and computer equipment

Abstract

The present application discloses a CAN message detection method, detection device, processor and computer equipment, which belongs to the field of vehicle network security detection technology. The detection method includes: obtaining event-type CAN messages within a preset time period, wherein the event-type CAN message includes the signal value of the target signal; determining the change frequency of the signal value within the preset time period; determining the signal state of the target signal according to the change frequency and the preset change frequency threshold corresponding to the target signal; and determining the security detection result of the event-type CAN message according to the signal state. The present application can detect event-type CAN messages with injected values ​​within the normal range sent to the CAN bus at any frequency, expand the detection range of attacks on the CAN bus, and thus improve the security of the CAN bus.

Description

Technical Field

[0001] The present application relates to the technical field of vehicle network security detection, and specifically to a CAN message detection method, detection device, processor and computer equipment. Background Art

[0002] Today, cars are widely automated and equipped with a range of sensors and computing systems. There are more than 100 automotive controllers, and this number is expected to increase in the future. These automotive controllers are distributed around the car and communicate with each other through in-vehicle communication networks such as the Controller Area Network (CAN). As the most common in-vehicle communication protocol in vehicle applications, the CAN bus has the advantages of low cost, immunity to electrical interference, self-diagnosis and error correction. Although the CAN bus has many advantages, the increasing inter-vehicle and intra-vehicle communications make the CAN bus vulnerable to cyber attacks.

[0003] Existing technologies usually detect attacks on the CAN bus by deploying a signal anomaly detection engine on the vehicle controller. However, if an attacker sends event-type CAN messages to the CAN bus at any frequency and the injected value is within the normal range, the existing signal anomaly detection method is difficult to detect such abnormal messages. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a CAN message detection method, detection device, processor and computer equipment to solve the problem that the signal anomaly detection method in the prior art is difficult to detect event-type CAN messages whose values ​​injected by attackers are within the normal range.

[0005] In order to achieve the above-mentioned object, a first aspect of an embodiment of the present application provides a method for detecting a CAN message, wherein the CAN message includes an event-type CAN message, and the detection method includes:

[0006] Acquire an event-type CAN message within a preset time period, wherein the event-type CAN message includes a signal value of a target signal;

[0007] determining the frequency of changes in the signal value within a preset time period;

[0008] Determining a signal state of the target signal according to the change frequency and a preset change frequency threshold corresponding to the target signal;

[0009] Determine the safety detection result of event-type CAN message according to the signal status.

[0010] In an embodiment of the present application, the detection method also includes: obtaining a rule file; determining a detection condition from the rule file, the detection condition being any one of unconditional detection, on detection condition, off detection condition and mixed detection condition; judging whether the target signal meets the detection condition; if the target signal meets the detection condition, detecting the signal value of the target signal according to the detection condition; if the target signal does not meet the detection condition, filtering the target signal.

[0011] In an embodiment of the present application, determining the frequency of change of the signal value within a preset time period includes: obtaining the number of signal changes of the signal value within the preset time period; and determining the frequency of change of the signal value within the preset time period based on the length of the preset time period and the number of signal changes.

[0012] In an embodiment of the present application, obtaining the number of signal changes of a signal value within a preset time period includes: obtaining a historical signal value of a historical signal within the preset time period, wherein the name of the historical signal is the same as the name of the target signal; determining whether the signal value and the historical signal value are the same; if the signal value and the historical signal value are the same, filtering the signal value; if the signal value and the historical signal value are different, increasing the number of signal changes.

[0013] In an embodiment of the present application, determining the signal state of the target signal based on the change frequency and the preset change frequency threshold corresponding to the target signal includes: judging whether the change frequency is greater than the preset change frequency threshold; when the change frequency is greater than the preset change frequency threshold, determining that the signal state is an abnormal state; when the change frequency is less than or equal to the preset change frequency threshold, determining that the signal state is a normal state.

[0014] In an embodiment of the present application, the detection method further includes: sending an alarm message when the signal state is an abnormal state.

[0015] A second aspect of an embodiment of the present application provides a CAN message detection device, comprising: a message acquisition module, used to acquire event-type CAN messages within a preset time period, wherein the event-type CAN messages include the signal value of a target signal; a change frequency determination module, used to determine the change frequency of the signal value within the preset time period; a signal state determination module, used to determine the signal state of the target signal based on the change frequency and a preset change frequency threshold corresponding to the target signal; and a detection result determination module, used to determine the safety detection result of the event-type CAN message based on the signal state.

[0016] A third aspect of an embodiment of the present application provides a processor configured to execute the above-mentioned CAN message detection method.

[0017] A fourth aspect of an embodiment of the present application provides a computer device, comprising the above-mentioned CAN message detection device or the above-mentioned processor.

[0018] A fifth aspect of an embodiment of the present application provides a machine-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the above-mentioned CAN message detection method is implemented.

[0019] The above technical solution obtains event-type CAN messages within a preset time period, and the event-type CAN messages include the signal value of the target signal, then determines the change frequency of the signal value within the preset time period, and then determines the signal state of the target signal according to the change frequency and the preset change frequency threshold corresponding to the target signal, and finally determines the security detection result of the event-type CAN message according to the signal state. The present application detects event-type CAN messages with values ​​injected by attackers within a normal range by determining the change frequency of the signal value within a preset time period, which can further expand the detection range of attacks on the CAN bus, thereby improving the security of the CAN bus.

[0020] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0022] Figure 1 A flowchart of a CAN message detection method according to an embodiment of the present application is schematically shown;

[0023] Figure 2 A flowchart of a CAN message detection method according to a specific embodiment of the present application is schematically shown;

[0024] Figure 3 The structural block diagram of a CAN message detection device according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0026] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back...), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0027] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0028] Figure 1 The flowchart of a CAN message detection method according to an embodiment of the present application is schematically shown. Figure 1 As shown, an embodiment of the present application provides a method for detecting a CAN message, wherein the CAN message includes an event-type CAN message. Taking the detection method applied to a processor as an example, the detection method may include the following steps:

[0029] Step S101: Acquire event-type CAN messages within a preset time period, wherein the event-type CAN messages include a signal value of a target signal.

[0030] Step S102: determining the frequency of change of the signal value within a preset time period.

[0031] Step S103: determining the signal state of the target signal according to the change frequency and a preset change frequency threshold corresponding to the target signal.

[0032] Step S104: Determine the safety detection result of the event-type CAN message according to the signal status.

[0033] CAN messages on the Controller Area Network (CAN) bus are generally divided into periodic CAN messages and event CAN messages. Event CAN messages are not limited by the period, and attackers can send event CAN messages to the CAN bus at any frequency. The common attack method used by attackers is to inject event CAN messages into the CAN bus, and the signal values ​​carried in the event CAN messages are constantly changing, such as sending signals to turn off the lights quickly and open and close the doors, etc., when the signal values ​​are within the normal range. In this case, the existing signal anomaly detection method cannot detect such attacks.

[0034] To solve the above-mentioned problems, for event-type CAN messages, in an embodiment of the present application, the processor will parse the rule file after the first startup, and save the detection strategy of the rule file into the internal rule structure for subsequent processor use. Among them, the rule file is stored in JSON format. The processor can obtain the duration of the preset time period from the rule file to determine the preset time period according to the duration of the preset time period, and count the time through the timer. When the timer starts counting, the processor can obtain the event-type CAN message through the CAN message receiving device. The CAN message receiving device includes a CAN message transceiver unit and a CAN controller. The CAN message transceiver unit can convert the CAN message into high and low levels and send it to the CAN bus, or read the high and low levels on the CAN bus and convert them into CAN messages. The CAN controller can be used to implement operations such as routing and assembly of CAN messages.

[0035] The signal value carried in the event-type CAN message can express many attributes of the car, such as the door status, vehicle speed, etc. After the processor obtains the name of the target signal from the rule file, the processor can further extract the extraction information of the target signal from the database file according to the name of the target signal, and the extraction information includes the event-type CAN message identifier where the target signal is located, the start bit, length, byte order, symbol type, factor and offset of the target signal. In this way, the processor can extract the signal value of the target signal from the acquired event-type CAN message according to the extraction information. Among them, the target signal can be one signal in the event-type CAN message, or it can be multiple signals, determined according to the rule file. By comparing the signal value of the target signal with the historical signal value of the historical signal, the change frequency of the signal value of the target signal within a preset time period can be determined.

[0036] The target signal is provided with a corresponding preset change frequency threshold. Thus, when the timer ends, the processor can further determine the signal state of the target signal according to the change frequency and the preset change frequency threshold corresponding to the target signal. The preset change frequency threshold is set according to the actual situation. The signal state includes a normal state and an abnormal state. When the change frequency is greater than the preset change frequency threshold, the processor can determine that the target signal is in an abnormal state. When the change frequency is less than or equal to the preset change frequency threshold, the processor can determine that the target signal is in a normal state.

[0037] Finally, the processor can determine the security detection result of the event-type CAN message according to the signal state. Specifically, when there is a target signal in an abnormal state exceeding the first preset ratio, the processor can determine that the security detection result is that the CAN bus is attacked. When there is a target signal in a normal state exceeding the second preset ratio, the processor can determine that the security detection result is that the CAN bus is not attacked. The first preset ratio and the second preset ratio are set according to the actual situation. In this way, the processor can complete the detection process of the event-type CAN message.

[0038] In addition, the aforementioned CAN message detection method can be compiled into a static library, which provides a CAN message detection interface. In this way, the static library can be referenced through the CAN message detection interface. After the device source code is compiled and burned into the vehicle gateway device, through the CAN message detection interface, after the vehicle gateway device is started, the event-type CAN message with a value injected by the attacker within the normal range can be detected.

[0039] The above technical solution obtains event-type CAN messages within a preset time period, and the event-type CAN messages include the signal value of the target signal, then determines the change frequency of the signal value within the preset time period, and then determines the signal state of the target signal according to the change frequency and the preset change frequency threshold corresponding to the target signal, and finally determines the security detection result of the event-type CAN message according to the signal state. The present application detects event-type CAN messages with values ​​injected by attackers within a normal range by determining the change frequency of the signal value within a preset time period, which can further expand the detection range of attacks on the CAN bus, thereby improving the security of the CAN bus.

[0040] In an embodiment of the present application, the detection method may further include: obtaining a rule file; determining a detection condition from the rule file, the detection condition being any one of unconditional detection, on detection condition, off detection condition and mixed detection condition; judging whether the target signal meets the detection condition; if the target signal meets the detection condition, detecting the signal value of the target signal according to the detection condition; if the target signal does not meet the detection condition, filtering the target signal.

[0041] In an embodiment of the present application, a rule file is a file that defines the detection conditions for event-type CAN messages within a preset time period. Before determining the frequency of change of the signal value within the preset time period, the processor can determine the detection conditions of the target signal from the rule file, and the detection conditions include unconditional detection, start detection conditions, stop detection conditions, and mixed detection conditions. In the case where the detection condition of the target signal is unconditional detection, the processor starts to detect the signal value of the target signal when it obtains the target signal. In one example, if the signal value of the door status signal needs to be detected, the processor can start monitoring the frequency of change of the signal value of the door status signal when the first door status signal is received.

[0042] When the detection condition of the target signal is the start detection condition, the processor can determine whether it is necessary to detect the signal value of the target signal according to the preset start condition. The preset start condition can be an event-type CAN message of the target, or it can be that the signal value of the target signal is detected to meet the start requirement. In one example, if the processor needs to detect the signal value of the air-conditioning temperature signal, then the signal value of the air-conditioning temperature signal can be detected when the signal value of the air-conditioning start signal is detected.

[0043] When the detection condition of the target signal is a stop detection condition, the processor can determine whether to stop detecting the signal value of the target signal according to the preset stop condition. Similarly, the preset stop condition can be an event-type CAN message of the target, or it can be a signal value of the target signal that meets the stop requirement. In one example, if the processor needs to stop detecting the signal value of the air-conditioning temperature signal, then the signal value of the air-conditioning temperature signal can be stopped when the signal value of the air-conditioning off signal is detected.

[0044] There are preset start conditions, preset stop conditions, and priorities between the preset start conditions and the preset stop conditions in the mixed detection conditions. When the preset start conditions and the preset stop conditions are triggered at the same time, the preset conditions with higher priorities are executed first. Therefore, when the detection condition of the target signal is a mixed detection condition, the processor can determine whether to detect the signal value of the target signal according to the preset start conditions and the preset stop conditions, that is, to detect the signal value when the signal value meets the preset start conditions, and to stop detecting the signal value when the signal value meets the preset stop conditions. If the target signal does not meet the mixed detection conditions, it is necessary to filter out the target signal. In one example, if it is necessary to detect the signal value of the wiper angle signal, the preset start condition may be the signal value of the wiper turn-on signal detected, and the preset stop condition may be the signal value of the wiper turn-off signal detected.

[0045] In an embodiment of the present application, determining the change frequency of the signal value within a preset time period may include: obtaining the number of signal changes in the signal value within the preset time period; and determining the change frequency of the signal value within the preset time period based on the length of the preset time period and the number of signal changes.

[0046] In an embodiment of the present application, the attacker injects a message that causes the value of the signal value to change too quickly within a preset time period. Therefore, in order to determine whether the CAN bus is attacked based on the frequency of changes in the signal value within the preset time period, the processor needs to first determine the frequency of changes in the signal value within the preset time period. The processor can obtain the length of the preset time period from the rule file to determine the preset time period based on the length of the preset time period, and count the time through a timer. Within the preset time period, the processor can obtain the number of signal changes of the signal value, thereby determining the frequency of changes in the signal value within the preset time period based on the length of the preset time period and the number of signal changes.

[0047] In an embodiment of the present application, obtaining the number of signal changes of a signal value within a preset time period may include: obtaining a historical signal value of a historical signal within the preset time period, the name of the historical signal being the same as the name of the target signal; determining whether the signal value and the historical signal value are the same; if the signal value and the historical signal value are the same, filtering the signal value; if the signal value and the historical signal value are different, increasing the number of signal changes.

[0048] In an embodiment of the present application, the processor also includes a plurality of counters corresponding to the target signals. Through the plurality of counters corresponding to the target signals, the processor can obtain the number of signal changes of the signal value within a preset time period. The processor can obtain the historical signal value of the historical signal. Among them, the historical signal refers to the target signal last obtained by the processor within the preset time period, and the name of the historical signal is the same as the name of the target signal. In this way, the processor can determine whether the signal value and the historical signal value are the same. If they are the same, the processor can filter out the signal value of the target signal. If they are not the same, the processor can control the number of signal changes counted by the counter corresponding to the target signal to increase by one. The processor can repeat the above process until the preset time period ends to obtain the number of signal changes of the signal value within the preset time period.

[0049] In an embodiment of the present application, determining the signal state of the target signal based on the change frequency and the preset change frequency threshold corresponding to the target signal includes: judging whether the change frequency is greater than the preset change frequency threshold; when the change frequency is greater than the preset change frequency threshold, determining that the signal state is an abnormal state; when the change frequency is less than or equal to the preset change frequency threshold, determining that the signal state is a normal state.

[0050] In an embodiment of the present application, when the timer ends, the processor can determine the signal state of the target signal according to the change frequency and the preset change frequency threshold corresponding to the target signal. The preset change frequency threshold is set according to the actual situation. The signal state includes a normal state and an abnormal state. When the change frequency is greater than the preset change frequency threshold, the processor can determine that the target signal is in an abnormal state. When the change frequency is less than or equal to the preset change frequency threshold, the processor can determine that the target signal is in a normal state.

[0051] In an embodiment of the present application, the detection method further includes: sending an alarm message when the signal state is an abnormal state.

[0052] In the embodiment of the present application, the signal state includes a normal state and an abnormal state. When the change frequency is greater than a preset change frequency threshold, the processor can determine that the signal state is an abnormal state, and then send an alarm message for the abnormal state to prompt the security personnel that the current CAN bus is likely to be attacked, so that the security personnel can take corresponding strategies in time according to the alarm message.

[0053] Figure 2 The flowchart of a method for detecting a CAN message according to a specific embodiment of the present application is schematically shown. Figure 2 As shown, in a specific embodiment of the present application, the CAN message detection method may include:

[0054] S1: Parsing rule file.

[0055] S2: Parse the database file.

[0056] S3: Receive event-type CAN messages.

[0057] S4: Extract the signal value of the target signal.

[0058] S5: Determine whether the target signal meets the detection conditions. If yes, go to S6, if not, go to S3.

[0059] S6: Determine whether the signal value has changed. If so, go to S7, if not, go to S3.

[0060] S7: Counter increments.

[0061] In a specific embodiment, the detection method of the CAN message is configured in the form of rules, and the rule file is stored in the format of JSON. The processor will parse the rule file after the first startup, and save the detection strategy of the rule file into the internal rule structure of the program for subsequent processors to use. In addition, after parsing the rule file, the processor can obtain the name of the signal to be detected, that is, the name of the target signal. The processor can further extract the extraction information of the target signal from the database file, including the event-type CAN message identifier where the target signal is located, the start bit, length, byte order, and symbol type of the target signal, and save these extraction information in the internal rule structure for subsequent processor detection. Furthermore, the processor can extract the signal value of the target signal from the received event-type CAN message according to the extraction information, and determine whether the target signal meets the detection conditions. If the target signal does not meet the detection conditions, the target signal is ignored. If the target signal meets the detection conditions, the signal value of the target signal is compared with the historical signal value of the historical signal to determine whether the signal value has changed. If the signal value changes, one is added to the counter corresponding to the target signal, and the signal value of the current target signal is recorded as the historical signal value of the historical signal, so as to facilitate comparison when the next event-type CAN message is obtained. In this way, the processor can traverse the counter of each target signal and determine whether the change frequency exceeds the preset change frequency threshold set for the corresponding signal. If it exceeds, it is determined to be an abnormal state and an alarm is processed. After the above process is completed, the counter is reset.

[0062] In summary, the technical solution provided by the embodiment of the present application has the following advantages compared with the prior art:

[0063] 1) In an attack scenario where an attacker accesses the CAN bus in the vehicle and attempts to reverse the meaning of the signal by injecting event-type CAN messages, the attacker injects event-type CAN messages into the CAN bus, and the signal value in the event-type CAN message is within the normal range, which can effectively bypass the detection of the message cycle detection engine and the signal range detection engine in the prior art. By accumulating the signal value, the attacker can check the switching of the vehicle status or interfere with the normal driving of the driver by frequently switching the status expressed by a certain signal. The present application can detect this attack scenario and perform an alarm by detecting whether the change frequency of the signal value in the vehicle CAN bus exceeds the corresponding preset change frequency threshold.

[0064] 2) This application supports four different detection conditions, namely unconditional detection, start detection condition, stop detection condition and mixed detection condition, making signal detection more flexible.

[0065] 3) This application supports parsing of rule files and database files. You only need to configure the rule files and import the database files according to the format, and you can automatically generate detection rules based on the rule files and database files for the processor to use.

[0066] An embodiment of the present application also provides a processor configured to execute the above-mentioned CAN message detection method.

[0067] Figure 3 The structure block diagram of a CAN message detection device according to an embodiment of the present application is schematically shown. Figure 3 As shown, the embodiment of the present application also provides a CAN message detection device, including:

[0068] The message acquisition module 310 is used to acquire event-type CAN messages within a preset time period, wherein the event-type CAN messages include the signal value of the target signal.

[0069] The change frequency determination module 320 is used to determine the change frequency of the signal value within a preset time period.

[0070] The signal state determination module 330 is used to determine the signal state of the target signal according to the change frequency and a preset change frequency threshold corresponding to the target signal.

[0071] The detection result determination module 340 is used to determine the security detection result of the event-type CAN message according to the signal state.

[0072] The above technical solution obtains event-type CAN messages within a preset time period, and the event-type CAN messages include the signal value of the target signal, then determines the change frequency of the signal value within the preset time period, and then determines the signal state of the target signal according to the change frequency and the preset change frequency threshold corresponding to the target signal, and finally determines the security detection result of the event-type CAN message according to the signal state. The present application detects event-type CAN messages with values ​​injected by attackers within a normal range by determining the change frequency of the signal value within a preset time period, which can further expand the detection range of attacks on the CAN bus, thereby improving the security of the CAN bus.

[0073] In one embodiment, the detection device for CAN messages also includes a signal value filtering module, which is used to: obtain a rule file; determine a detection condition from the rule file, the detection condition being any one of unconditional detection, start detection condition, stop detection condition and mixed detection condition; judge whether the target signal meets the detection condition; if the target signal meets the detection condition, detect the signal value of the target signal according to the detection condition; if the target signal does not meet the detection condition, filter the target signal.

[0074] In one embodiment, the change frequency determination module 320 is further used to: obtain the number of signal changes of the signal value within a preset time period; and determine the change frequency of the signal value within the preset time period according to the length of the preset time period and the number of signal changes.

[0075] In one embodiment, the change frequency determination module 320 is also used to: obtain the historical signal value of the historical signal within a preset time period, and the name of the historical signal is the same as the name of the target signal; determine whether the signal value and the historical signal value are the same; if the signal value and the historical signal value are the same, filter the signal value; if the signal value and the historical signal value are different, increase the number of signal changes.

[0076] In one embodiment, the signal status determination module 330 is also used to: determine whether the change frequency is greater than a preset change frequency threshold; when the change frequency is greater than the preset change frequency threshold, determine that the signal status is an abnormal status; when the change frequency is less than or equal to the preset change frequency threshold, determine that the signal status is a normal status.

[0077] In one embodiment, the CAN message detection device further includes an alarm information sending module, which is used to send alarm information when the signal state is abnormal.

[0078] An embodiment of the present application also provides a computer device, including the above-mentioned CAN message detection device or the above-mentioned processor.

[0079] An embodiment of the present application also provides a machine-readable storage medium, on which instructions are stored, and the instructions are used to enable a machine to execute the above-mentioned CAN message detection method.

[0080] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0081] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0082] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0083] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0084] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0085] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0086] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0087] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0088] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for detecting a CAN message, characterized in that: The CAN message includes an event-type CAN message, and the detection method includes: Acquire an event-type CAN message within a preset time period, wherein the event-type CAN message includes a signal value of a target signal; Acquire a historical signal value of a historical signal within the preset time period, wherein the name of the historical signal is the same as the name of the target signal; Determining whether the signal value is the same as the historical signal value; When the signal value is the same as the historical signal value, filtering the signal value; When the signal value is different from the historical signal value, increasing the number of signal changes; Determining the frequency of change of the signal value within the preset time period according to the length of the preset time period and the number of times the signal changes; determining a signal state of the target signal according to the change frequency and a preset change frequency threshold corresponding to the target signal; Determine the safety detection result of the event-type CAN message according to the signal state; The change frequency is the number of times the signal value changes within the preset time period.

2. The detection method according to claim 1, characterized in that: The detection method further comprises: Get the rules file; Determine a detection condition from the rule file, where the detection condition is any one of unconditional detection, start detection condition, stop detection condition and mixed detection condition; Determining whether the target signal meets the detection condition; When the target signal meets the detection condition, detecting the signal value of the target signal according to the detection condition; When the target signal does not meet the detection condition, the target signal is filtered.

3. The detection method according to claim 1, characterized in that: The determining the signal state of the target signal according to the change frequency and a preset change frequency threshold corresponding to the target signal includes: Determining whether the change frequency is greater than a preset change frequency threshold; When the change frequency is greater than the preset change frequency threshold, determining that the signal state is an abnormal state; When the change frequency is less than or equal to the preset change frequency threshold, it is determined that the signal state is a normal state.

4. The detection method according to claim 3, characterized in that: The detection method further comprises: When the signal state is abnormal, an alarm message is sent.

5. A CAN message detection device, characterized in that: include: A message acquisition module, used to acquire event-type CAN messages within a preset time period, wherein the event-type CAN messages include a signal value of a target signal; A change frequency determination module, used to obtain a historical signal value of a historical signal within the preset time period, wherein the name of the historical signal is the same as the name of the target signal; determine whether the signal value is the same as the historical signal value; if the signal value is the same as the historical signal value, filter the signal value; if the signal value is different from the historical signal value, increase the number of signal changes; determine the change frequency of the signal value within the preset time period according to the length of the preset time period and the number of signal changes; a signal state determination module, configured to determine a signal state of the target signal according to the change frequency and a preset change frequency threshold corresponding to the target signal; A detection result determination module, used to determine the safety detection result of the event-type CAN message according to the signal state; The change frequency is the number of times the signal value changes within the preset time period.

6. A processor, characterized in that: The method is configured to execute the CAN message detection method according to any one of claims 1 to 4.

7. A computer device, characterized in that: The method comprises the device for detecting CAN messages according to claim 5 or the processor according to claim 6.

8. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores instructions, which are used to enable a machine to implement the CAN message detection method according to any one of claims 1 to 4 when the instructions are executed.

Images