Abnormal message detection method, device, electronic device and computer readable medium

Abstract

The embodiments of the present disclosure disclose an abnormal message detection method, device, electronic device and computer-readable medium. A specific implementation of the method includes: receiving encrypted message information to be processed; decrypting the encrypted bus message to be processed to obtain the bus message to be processed and the message encryption random number; matching the bus message to be processed with the preset whitelist rule information to obtain a matching result; in response to determining that the matching result meets the preset matching condition, based on the message encryption random number, performing flow monitoring processing on the bus message to be processed to obtain a flow monitoring result; in response to determining that the flow monitoring result meets the preset flow monitoring condition, inputting the bus message to be processed into a pre-trained message anomaly detection model to obtain an anomaly detection result; in response to determining that the anomaly detection result meets the preset anomaly detection condition, sending the bus message to be processed to the vehicle control terminal for controlling the vehicle. This implementation improves the safety of vehicle control.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to an abnormal message detection method, device, electronic device, and computer-readable medium. Background Art

[0002] When the Controller Area Network bus is used to transmit vehicle control messages, there may be abnormal situations where the Controller Area Network bus is attacked externally or the vehicle control message data is lost, and the vehicle control message needs to be detected for abnormalities in a timely manner. At present, when performing abnormal message detection, the commonly used method is: filtering messages through a whitelist, or using a single message anomaly detection algorithm (for example, a frequency-based message anomaly detection algorithm or an information entropy-based message anomaly detection algorithm) to detect the received vehicle control messages, so as to use the messages detected without abnormalities to control the vehicle driving.

[0003] However, in practice, it is found that when the above method is used to detect abnormal messages, the following technical problems often occur:

[0004] First, by only using the whitelist to filter messages, the attacker can still generate messages that can pass the whitelist through a preset algorithm (e.g., a reverse algorithm), thereby reducing the security of vehicle messages and, in turn, the security of vehicle control;

[0005] Second, using a single message anomaly detection algorithm can only identify a single type of abnormal message, and it is difficult to detect complex abnormal messages, which leads to reduced security of vehicle messages and, in turn, reduced security of vehicle control;

[0006] Third, the use of plain text to transmit vehicle control messages directly on the controller area network bus is easy to be stolen and tampered with, resulting in reduced security of vehicle messages and, in turn, reduced security of vehicle control.

[0007] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0008] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0009] Some embodiments of the present disclosure provide an abnormal message detection method, an apparatus, an electronic device, and a computer-readable medium to solve one or more of the technical problems mentioned in the above background technology section.

[0010] In a first aspect, some embodiments of the present disclosure provide an abnormal message detection method, which includes: receiving encrypted bus message information to be processed; decrypting the encrypted bus message to be processed to obtain a bus message to be processed and a message encryption random number; matching the bus message to be processed with preset whitelist rule information to obtain a matching result; in response to determining that the matching result meets the preset matching condition, based on the message encryption random number, performing flow monitoring on the bus message to be processed to obtain a flow monitoring result; in response to determining that the flow monitoring result meets the preset flow monitoring condition, inputting the bus message to be processed into a pre-trained message anomaly detection model to obtain an anomaly detection result; in response to determining that the anomaly detection result meets the preset anomaly detection condition, sending the bus message to be processed to a vehicle control terminal for controlling the vehicle.

[0011] In a second aspect, some embodiments of the present disclosure provide an abnormal message detection device, the device comprising: a receiving unit, configured to receive encrypted bus message information to be processed; a decryption unit, configured to decrypt the encrypted bus message to be processed to obtain a bus message to be processed and a message encryption random number; a matching unit, configured to match the bus message to be processed with preset whitelist rule information to obtain a matching result; a flow monitoring unit, configured to, in response to determining that the matching result satisfies a preset matching condition, perform flow monitoring on the bus message to be processed based on the message encryption random number to obtain a flow monitoring result; an abnormality detection unit, configured to, in response to determining that the flow monitoring result satisfies the preset flow monitoring condition, input the bus message to be processed into a pre-trained message abnormality detection model to obtain an abnormality detection result; a sending unit, configured to, in response to determining that the abnormality detection result satisfies the preset abnormality detection condition, send the bus message to be processed to a vehicle control terminal for controlling the vehicle.

[0012] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation method in the above-mentioned first aspect.

[0013] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any one of the implementations in the first aspect above is implemented.

[0014] The above-mentioned embodiments of the present disclosure have the following beneficial effects: the abnormal message detection method of some embodiments of the present disclosure can improve the security of vehicle control. Specifically, the reason for the insufficient reduction of the security of vehicle control is that only the whitelist is used to filter the message, and the attacker can still generate a message that can pass the whitelist through a preset algorithm (for example, a reverse algorithm), thereby reducing the security of the vehicle message. Based on this, the abnormal message detection method of some embodiments of the present disclosure first receives the encrypted bus message information to be processed. Secondly, the above-mentioned encrypted bus message to be processed is decrypted to obtain the bus message to be processed and the message encryption random number. Thus, the security of the vehicle message can be improved by transmitting the encrypted vehicle message and the message encryption random number that can uniquely determine a vehicle message. Subsequently, the above-mentioned bus message to be processed is matched with the preset whitelist rule information to obtain a matching result. Thus, the bus message to be processed can be preliminarily detected through the whitelist. Then, in response to determining that the above-mentioned matching result meets the preset matching condition, based on the above-mentioned message encryption random number, the above-mentioned bus message to be processed is subjected to flow monitoring processing to obtain a flow monitoring result. Thus, by monitoring the bus traffic for a certain period of time before the bus message to be processed, it can be determined whether it is subjected to a frequency-based bus attack. Then, in response to determining that the above-mentioned traffic monitoring result meets the preset traffic monitoring condition, the above-mentioned bus message to be processed is input into the pre-trained message anomaly detection model to obtain the anomaly detection result. Thus, the abnormal message can be further identified by the message anomaly detection model. Finally, in response to determining that the above-mentioned anomaly detection result meets the preset anomaly detection condition, the above-mentioned bus message to be processed is sent to the vehicle control terminal for controlling the vehicle. Thus, the bus message without abnormality after detection can be used to control the vehicle. Therefore, some abnormal message detection methods disclosed in the present invention can perform abnormal detection on the above-mentioned bus message to be processed by whitelist filtering, traffic monitoring and abnormal identification of the bus message to be processed in turn, so as to control the vehicle using the message without abnormality detected. Thus, the possibility of identifying the abnormal message generated by the attacker can be improved, thereby improving the security of the vehicle message, and then, the security of the vehicle control can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0016] Figure 1 is a flow chart of some embodiments of the abnormal message detection method according to the present disclosure;

[0017] Figure 2It is a structural schematic diagram of some embodiments of the abnormal message detection device according to the present disclosure;

[0018] Figure 3 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0019] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0020] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0021] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0022] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0023] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0024] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0025] Figure 1 The process 100 of some embodiments of the abnormal message detection method according to the present disclosure is shown. The abnormal message detection method comprises the following steps:

[0026] Step 101, receiving encrypted bus message information to be processed.

[0027] In some embodiments, the execution subject of the abnormal message detection method can receive the encrypted bus message information to be processed from the bus network of the target vehicle through a wired connection or a wireless connection. The target vehicle can be a moving vehicle. The bus network can be a vehicle bus network for transmitting vehicle control messages.

[0028] As an example, the vehicle bus network may be a CAN (Controller Area Network).

[0029] Optionally, the encrypted bus message information to be processed may be generated by the following steps:

[0030] The first step is to generate an initial encryption key, an initial bus message and a message encryption random number. The message sending terminal can generate the initial encryption key through a preset generator. The message sending terminal can generate the initial bus message and the message encryption random number according to the status information of the target vehicle. The message sending terminal can be a terminal for sending the encrypted bus message information to be processed. The message encryption random number can uniquely identify an initial bus message. The message encryption random number can be but not limited to at least one of the following: a timestamp corresponding to the initial bus message, a random number or a random string.

[0031] As an example, the preset generator may be a random number generator. The message sending terminal may be an ECU (Electronic Control Unit).

[0032] The second step is to concatenate the initial bus message and the message encryption random number to obtain the message data to be encrypted. The initial bus message and the message encryption random number can be concatenated in the order of the message encryption random number first and the initial bus message later to obtain the message data to be encrypted.

[0033] The third step is to perform expansion processing on the initial encryption key to obtain an encryption subkey sequence. The initial encryption key can be expanded using a preset expansion algorithm to obtain an encryption subkey sequence.

[0034] As an example, the above-mentioned preset expansion algorithm may be a key expansion algorithm.

[0035] Step 4: For each encryption subkey in the above encryption subkey sequence, perform the following encryption substeps:

[0036] The first sub-step is to perform an XOR process on the encryption sub-key and the message data to be encrypted corresponding to the encryption sub-key to obtain first encrypted message data.

[0037] The second sub-step is to perform substitution processing on the first encrypted message data to obtain second encrypted message data. The first encrypted message data can be substituted by a preset substitution algorithm to obtain the second encrypted message data.

[0038] As an example, the above-mentioned preset substitution algorithm may be an S-box (Substitution box) substitution algorithm.

[0039] The third sub-step is to perform row shift processing on the second encrypted message data to obtain third encrypted message data. First, the second encrypted message data can be converted into an encrypted message matrix. Then, the second row of the encrypted message matrix can be shifted to the left by one byte. Then, the third row of the encrypted message matrix can be shifted to the left by two bytes. Subsequently, the fourth row of the encrypted message matrix can be shifted to the left by three bytes.

[0040] In a fourth sub-step, in response to determining that the encryption subkey satisfies a preset encryption condition, performing an XOR process on the third encrypted message data and the encryption subkey to obtain target encrypted message data, wherein the preset encryption condition may be that the encryption subkey is the last encryption subkey in the encryption subkey sequence.

[0041] The fifth step is to merge the target encrypted message data and the encryption subkey sequence to obtain the encrypted bus message information to be processed. The target encrypted message data and the encryption subkey sequence can be determined as the target encrypted message data and the encryption subkey sequence included in the encrypted bus message information to be processed.

[0042] Optionally, the message sending terminal may further perform the following steps:

[0043] In the first step, in response to determining that the encryption subkey does not satisfy the preset encryption condition, the product of the third encrypted message data and a preset confusion matrix is ​​determined as the fourth encrypted message data. The preset confusion matrix may be a pre-generated confusion matrix.

[0044] The second step is to perform XOR processing on the fourth encrypted message data and the encryption subkey to obtain the fifth encrypted message data.

[0045] The third step is to determine the fifth encrypted message data as the message data to be encrypted corresponding to the next encryption subkey of the encryption subkey.

[0046] It should be noted that the above-mentioned wireless connection methods may include but are not limited to 3G / 4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0047] Step 102, decrypt the encrypted bus message to be processed to obtain the bus message to be processed and the message encryption random number.

[0048] In some embodiments, the execution subject may decrypt the encrypted bus message to be processed to obtain the bus message to be processed and the message encryption random number. First, according to the encryption subkey sequence included in the encrypted bus message information to be processed, the target encrypted message data included in the encrypted bus message information to be processed may be decrypted to obtain the message data to be encrypted. Here, the specific implementation method for generating the encrypted message data to be encrypted and the technical effect thereof may refer to step 101 in the above embodiment, which will not be described in detail. Then, the encrypted message data may be split to obtain the initial bus message and the message encryption random number. Finally, the initial bus message may be determined as the bus message to be processed.

[0049] Specifically, the above-mentioned bus message to be processed may be a message used to control the driving of the above-mentioned target vehicle. The above-mentioned bus message to be processed may include but is not limited to at least one of the following: address information of the bus message to be processed, message timestamp, identification of the terminal sending the message to be processed and message length value. The above-mentioned bus message address information to be processed may represent the sending address of the above-mentioned bus message to be processed. The above-mentioned message timestamp may represent the sending time of the above-mentioned bus message to be processed. The above-mentioned identification of the terminal sending the message to be processed may uniquely determine the message sending terminal used to send the above-mentioned bus message to be processed. The above-mentioned message length value may be the length value of the above-mentioned bus message to be processed.

[0050] As an example, the sending address information may be the CANid (Controller Area Network Identity document, bus identification) of the bus message to be processed.

[0051] The relevant contents of steps 101-102, as an inventive point of an embodiment of the present disclosure, solve the technical problem three "reduced security of vehicle control" mentioned in the background technology. Among them, the factors that lead to reduced security of vehicle control are often as follows: directly using plain text to transmit vehicle control messages on the controller local area network bus is easy to be stolen and tampered with, resulting in reduced security of vehicle messages, and then, reduced security of vehicle control. If the above factors are solved, the effect of improving the security of vehicle control can be achieved. In order to achieve this effect, the present disclosure can generate a unique message random number at the message sending terminal to indicate that the vehicle message has not been sent. Then, the message random number and the message content can be subjected to XOR, row substitution, row shift and obfuscation processing in sequence through the encryption key to encrypt the message random number and the message content together. In this way, the message random number and the message content can be protected together. Therefore, when the message is stolen or tampered with by the outside world, it can be discovered in time, the security of the vehicle message can be improved, and then, the security of vehicle control can be improved.

[0052] Step 103, matching the bus message to be processed with the preset whitelist rule information to obtain a matching result.

[0053] In some embodiments, the above-mentioned execution entity may match the above-mentioned bus message to be processed with the preset whitelist rule information to obtain a matching result. Among them, the above-mentioned preset whitelist rule information may be a preset whitelist rule. The above-mentioned preset whitelist rule information may include but is not limited to at least one of the following: a whitelist address information set and a message rule information set. The whitelist address information in the above-mentioned whitelist address information set may be a whitelist of preset message addresses. Each message rule information in the above-mentioned message rule information set may represent a message sending terminal identification set. Each message rule information in the above-mentioned message rule information set may also represent a message length interval. Here, each message sending terminal identification in the above-mentioned message sending terminal identification set can uniquely identify a message sending terminal.

[0054] As an example, the lower limit of the message length interval may be 12 bytes, and the upper limit of the message length interval may be 64 bytes.

[0055] In some optional implementations of some embodiments, the execution subject matches the bus message to be processed with the preset whitelist rule information to obtain a matching result, which may include the following steps:

[0056] The first step is, in response to determining that there is whitelist address information identical to the address information of the bus message to be processed included in the whitelist address information set included in the preset whitelist rule information, matching the bus message to be processed with each message rule information in the message rule information set included in the preset whitelist rule information to generate an initial message matching result, and obtaining an initial message matching result set. For example, when the message rule information represents a message sending terminal identification set, in response to determining that the message sending terminal identification included in the bus message to be processed is in the message sending terminal identification set, information representing "initial matching success" can be determined as the message initial matching result. In response to determining that the message sending terminal identification included in the bus message to be processed is not in the message sending terminal identification set, information representing "initial matching failure" can be determined as the message initial matching result. When the message rule information represents a message length interval, in response to determining that the message length value included in the bus message to be processed is within the message length interval, information representing "initial match success" can be determined as the message initial match result. In response to determining that the message length value included in the bus message to be processed is not within the message length interval, information representing "initial match failure" can be determined as the message initial match result.

[0057] In the second step, in response to determining that there is an initial message matching result that satisfies a preset initial matching condition in the initial message matching result set, the first preset matching information is determined as the matching result. The preset initial matching condition may be that the initial message matching result is information indicating "initial matching success". The first preset matching information may be information indicating "matching success".

[0058] Optionally, the execution subject may also determine the second preset matching information as the matching result in response to determining that there is no initial matching result satisfying the preset initial matching condition in the initial matching result set of the message. The second preset matching information may be information indicating "matching failure".

[0059] Step 104 , in response to determining that the matching result satisfies the preset matching condition, based on the message encryption random number, flow monitoring processing is performed on the bus message to be processed to obtain a flow monitoring result.

[0060] In some embodiments, the execution subject may, in response to determining that the matching result satisfies a preset matching condition, perform flow monitoring processing on the bus message to be processed based on the message encryption random number to obtain a flow monitoring result. The preset matching condition may be that the matching result is the first preset matching information.

[0061] In some optional implementations of some embodiments, the execution subject performs flow monitoring processing on the bus message to be processed based on the message encryption random number to obtain the flow monitoring result, which may include the following steps:

[0062] The first step is to obtain a second bus message set and an initial message encryption random number set within a preset time length before the message timestamp included in the above-mentioned bus message to be processed. Among them, the second bus message set and the initial message encryption random number set within a preset time length before the message timestamp included in the above-mentioned bus message to be processed can be obtained from the storage terminal. Each second bus message in the above-mentioned second bus message set includes: second bus message address information. The above-mentioned second bus message set can be obtained from the above-mentioned vehicle bus network. The second bus message in the above-mentioned second bus message set can be a message used to control the driving of the above-mentioned target vehicle. The second bus message in the above-mentioned second bus message set corresponds one-to-one to the initial message encryption random number in the above-mentioned initial message encryption random number set. The above-mentioned second bus message address information can represent the sending address information of the corresponding second bus message. The above-mentioned storage terminal can be a terminal for storing the above-mentioned second bus message set and the initial message encryption random number set.

[0063] As an example, the preset duration may be 3 minutes.

[0064] In the second step, for each second bus message in the second bus message set, in response to determining that the second bus message address information included in the second bus message is the same as the to-be-processed bus message address information included in the to-be-processed bus message, the second bus message is determined as the target bus message.

[0065] In the third step, in response to determining that the number of each target bus message is less than a preset message threshold, and there is no initial message encryption random number identical to the message encryption random number in the initial message encryption random number set, the first preset monitoring result is determined as the traffic monitoring result, and the message encryption random number is stored in the storage terminal. The first preset monitoring result may be information indicating that "no abnormality is detected in the monitoring".

[0066] As an example, the preset message threshold may be 100.

[0067] Optionally, the execution subject may also determine the second preset monitoring result as the traffic monitoring result in response to determining that the number of target bus messages in each determined target bus message is greater than or equal to the preset message threshold, or that the initial message encryption random number set contains an initial message encryption random number that is the same as the message encryption random number. The second preset monitoring result may be information indicating that "monitoring is abnormal".

[0068] Step 105 , in response to determining that the traffic monitoring result meets the preset traffic monitoring condition, the bus message to be processed is input into a pre-trained message anomaly detection model to obtain an anomaly detection result.

[0069] In some embodiments, the execution subject may, in response to determining that the traffic monitoring result satisfies a preset traffic monitoring condition, input the bus message to be processed into a pre-trained message anomaly detection model to obtain an anomaly detection result. The preset traffic monitoring condition may be that the traffic monitoring result is the first preset monitoring result. The pre-trained message anomaly detection model may be a pre-trained model that takes the bus message to be processed as input and takes the anomaly detection result as output. The anomaly detection result may be information indicating that "anomaly occurred in the detection" or information indicating that "no anomaly occurred in the detection".

[0070] Optionally, the pre-trained message anomaly detection model may be trained by the following steps:

[0071] The first step is to obtain a sample bus message set. The sample bus message set can be obtained from a preset message database. The preset message database can be a database for storing the sample bus message set. The sample bus message in the sample bus message set can be a message for controlling vehicle driving.

[0072] In the second step, a sample bus message is selected from the sample bus message set, and the following training sub-steps are performed:

[0073] In the first sub-step, the sample bus message is input into the feature extraction sub-model included in the initial message anomaly detection model to obtain the initial message feature information. Among them, the initial message anomaly detection model also includes: an attention sub-model and an anomaly classification sub-model. The sample bus message can be randomly selected from the above-mentioned sample bus message set. The above-mentioned initial message anomaly detection model can be an untrained model that takes the sample bus message as input and the initial anomaly detection result as output. The above-mentioned feature extraction sub-model can be used to extract the basic features of the above-mentioned sample bus message to generate the initial message feature information. The above-mentioned attention sub-model can be used to extract the temporal features of the above-mentioned initial message feature information to generate the initial message attention feature information. The above-mentioned anomaly classification sub-model can be used as a single classifier for classifying the initial message attention feature information to generate the initial anomaly detection result.

[0074] As an example, the feature extraction sub-model may be a DBN (Deep Belief Network) model. The initial attention sub-model may be a GRU (gated recurrent unit) model. The abnormal classification sub-model may be an OC-SVM (One-Class Support Vector Machine) model.

[0075] In the second sub-step, the initial message feature information is input into the attention sub-model included in the initial message anomaly detection model to obtain the initial message attention feature information.

[0076] In the third sub-step, the initial message attention feature information is input into the anomaly classification sub-model included in the initial message anomaly detection model to obtain the initial anomaly detection result.

[0077] The fourth sub-step is to determine the anomaly detection loss value corresponding to the initial anomaly detection result based on a preset loss function.

[0078] As an example, the preset loss function may be, but is not limited to, one of the following: a cross entropy loss function, a least squares function, or a classification cross entropy loss function.

[0079] A fifth sub-step, in response to determining that the anomaly detection loss value is less than the target threshold, determines the initial message anomaly detection model as the message anomaly detection model.

[0080] As an example, the target threshold mentioned above may be 0.01.

[0081] Optionally, the execution subject may also adjust relevant parameters in the initial message anomaly detection model in response to determining that the anomaly detection loss value is greater than or equal to the target threshold, determine the adjusted initial message anomaly detection model as the initial message anomaly detection model, and select a sample bus message from each sample bus message that has not been selected in the sample bus message set to perform the training step again. The relevant parameters in the initial message anomaly detection model may be adjusted by a preset adjustment algorithm.

[0082] As an example, the preset adjustment algorithm may be a back propagation algorithm or a stochastic gradient algorithm.

[0083] The relevant content of step 104, as an inventive point of an embodiment of the present disclosure, solves the second technical problem mentioned in the background technology, "reduced safety of vehicle control". Among them, the factors that lead to reduced safety of vehicle control are often as follows: using a single message anomaly detection algorithm, only a single type of abnormal message can be identified, and it is difficult to detect complex abnormal messages, thereby reducing the safety of vehicle messages. If the above factors are solved, the effect of improving the safety of vehicle control can be achieved. In order to achieve this effect, the present disclosure can extract the basic features of the bus message to be processed through the feature extraction sub-model included in the pre-trained message anomaly detection model, and then, the attention sub-model included in the pre-trained message anomaly detection model can be used to further extract the abnormal features of the bus message to be processed. Finally, the abnormal classification sub-model included in the pre-trained message anomaly detection model can be used to classify the extracted abnormal features of the bus message to be processed to determine whether the above-mentioned bus message to be processed is abnormal. Therefore, by extracting the features of the bus message to be processed and comparing them with the features of the pre-learned abnormal message, it can be determined whether the bus message to be processed is an abnormal message, and complex abnormal messages can be detected, thereby improving the safety of vehicle messages and, in turn, the safety of vehicle control.

[0084] Step 106 , in response to determining that the abnormality detection result satisfies a preset abnormality detection condition, the bus message to be processed is sent to the vehicle control terminal for controlling the vehicle.

[0085] In some embodiments, the execution subject may send the bus message to be processed to the vehicle control terminal for controlling the vehicle in response to determining that the abnormality detection result satisfies a preset abnormality detection condition. The preset abnormality detection condition may be that the abnormality detection result is information indicating that "no abnormality is detected".

[0086] Optionally, the above execution entity may further perform the following steps:

[0087] The first step is to discard the bus message to be processed in response to determining that the matching result does not satisfy the preset matching condition.

[0088] In the second step, in response to determining that the flow monitoring result does not meet the preset flow monitoring condition, the following processing sub-steps are executed:

[0089] The first sub-step is to discard the bus message to be processed.

[0090] The second sub-step is to disable each bus message corresponding to the address information of the bus message to be processed included in the bus message to be processed.

[0091] The third sub-step is to send the first preset warning information to the vehicle warning terminal for warning processing. The first preset warning information may be a warning information indicating "being attacked by replay". The warning information may be a warning text or a prompt sound. The vehicle warning terminal may be a terminal for displaying the warning text or emitting the prompt sound.

[0092] The third step is, in response to determining that the abnormality detection result does not meet the preset abnormality detection condition, discarding the bus message to be processed, and sending the second preset alarm information to the vehicle alarm terminal for alarm processing. The second preset alarm information may be an alarm information indicating that "the message is at risk of being intercepted". The alarm information may be a warning text or a prompt tone.

[0093] Optionally, the above execution entity may further perform the following steps:

[0094] The first step is to obtain a first bus message set within a preset unit time length before the message timestamp included in the above-mentioned bus message to be processed. Each first bus message in the above-mentioned first bus message set includes: a first bus message length value. The above-mentioned first bus message set can be obtained from the above-mentioned vehicle bus network. The first bus message in the above-mentioned first bus message set can be a message for controlling the driving of the above-mentioned target vehicle. The above-mentioned first bus message length value can be the length value of the above-mentioned first bus message.

[0095] As an example, the preset unit time length may be 1 minute.

[0096] In the second step, the sum of the first bus message length value included in each first bus message in the first bus message set and the message length value included in the to-be-processed bus message is determined as the unit message data volume.

[0097] The third step is to shut down the vehicle bus network in response to determining that the data volume of the unit message is greater than the preset data threshold, and send the third preset alarm information to the vehicle alarm terminal for alarm processing. The shutting down of the vehicle bus network may be to determine the preset bus state as the state of the vehicle bus network. The third preset alarm information may be an alarm message indicating that "an error has occurred in the vehicle bus network". The alarm message may be a warning text or a prompt tone.

[0098] As an example, the preset data threshold may be 400 bytes. The preset bus state may be a bus-off state.

[0099] The above-mentioned embodiments of the present disclosure have the following beneficial effects: the abnormal message detection method of some embodiments of the present disclosure can improve the security of vehicle control. Specifically, the reason for the insufficient reduction of the security of vehicle control is that only the whitelist is used to filter the message, and the attacker can still generate a message that can pass the whitelist through a preset algorithm (for example, a reverse algorithm), thereby reducing the security of the vehicle message. Based on this, the abnormal message detection method of some embodiments of the present disclosure first receives the encrypted bus message information to be processed. Secondly, the above-mentioned encrypted bus message to be processed is decrypted to obtain the bus message to be processed and the message encryption random number. Thus, the security of the vehicle message can be improved by transmitting the encrypted vehicle message and the message encryption random number that can uniquely determine a vehicle message. Subsequently, the above-mentioned bus message to be processed is matched with the preset whitelist rule information to obtain a matching result. Thus, the bus message to be processed can be preliminarily detected through the whitelist. Then, in response to determining that the above-mentioned matching result meets the preset matching condition, based on the above-mentioned message encryption random number, the above-mentioned bus message to be processed is subjected to flow monitoring processing to obtain a flow monitoring result. Thus, by monitoring the bus traffic for a certain period of time before the bus message to be processed, it can be determined whether it is subjected to a frequency-based bus attack. Then, in response to determining that the above-mentioned traffic monitoring result meets the preset traffic monitoring condition, the above-mentioned bus message to be processed is input into the pre-trained message anomaly detection model to obtain the anomaly detection result. Thus, the abnormal message can be further identified by the message anomaly detection model. Finally, in response to determining that the above-mentioned anomaly detection result meets the preset anomaly detection condition, the above-mentioned bus message to be processed is sent to the vehicle control terminal for controlling the vehicle. Thus, the bus message without abnormality after detection can be used to control the vehicle. Therefore, some abnormal message detection methods disclosed in the present invention can perform abnormal detection on the above-mentioned bus message to be processed by whitelist filtering, traffic monitoring and abnormal identification of the bus message to be processed in turn, so as to control the vehicle using the message without abnormality detected. Thus, the possibility of identifying the abnormal message generated by the attacker can be improved, thereby improving the security of the vehicle message, and then, the security of the vehicle control can be improved.

[0100] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of an abnormal message detection device. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the abnormal message detection device can be specifically applied to various electronic devices.

[0101] like Figure 2As shown, the abnormal message detection device 200 of some embodiments includes: a receiving unit 201, a decryption unit 202, a matching unit 203, a traffic monitoring unit 204, an abnormality detection unit 205 and a sending unit 206. Among them, the receiving unit 201 is configured to receive the encrypted bus message information to be processed; the decryption unit 202 is configured to decrypt the above-mentioned encrypted bus message to be processed to obtain the bus message to be processed and the message encryption random number; the matching unit 203 is configured to match the above-mentioned bus message to be processed with the preset whitelist rule information to obtain a matching result; the flow monitoring unit 204 is configured to respond to determining that the above-mentioned matching result meets the preset matching condition, based on the above-mentioned message encryption random number, perform flow monitoring on the above-mentioned bus message to be processed to obtain a flow monitoring result; the anomaly detection unit 205 is configured to respond to determining that the above-mentioned flow monitoring result meets the preset flow monitoring condition, input the above-mentioned bus message to be processed into a pre-trained message anomaly detection model to obtain an anomaly detection result; the sending unit 206 is configured to respond to determining that the above-mentioned anomaly detection result meets the preset anomaly detection condition, Send the above-mentioned bus message to be processed to the vehicle control terminal for controlling the vehicle.

[0102] It is understandable that the units recorded in the abnormal message detection device 200 are similar to those in the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the abnormal message detection method are also applicable to the abnormal message detection device 200 and the units contained therein, and will not be repeated here.

[0103] Reference below Figure 3 , which shows a schematic diagram of the structure of an electronic device 300 suitable for implementing some embodiments of the present disclosure. The electronic devices in some embodiments of the present disclosure may include but are not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3 The terminal device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0104] like Figure 3As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0105] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0106] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0107] It should be noted that the computer-readable medium recorded in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0108] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0109] The computer-readable medium may be included in the electronic device; or it may exist independently without being assembled into the electronic device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: receives encrypted bus message information to be processed; decrypts the encrypted bus message to be processed to obtain the bus message to be processed and the message encryption random number; matches the bus message to be processed with the preset whitelist rule information to obtain a matching result; in response to determining that the matching result meets the preset matching condition, based on the message encryption random number, performs flow monitoring on the bus message to be processed to obtain a flow monitoring result; in response to determining that the flow monitoring result meets the preset flow monitoring condition, inputs the bus message to be processed into a pre-trained message anomaly detection model to obtain an anomaly detection result; in response to determining that the anomaly detection result meets the preset anomaly detection condition, sends the bus message to be processed to the vehicle control terminal for controlling the vehicle.

[0110] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0111] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0112] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The units described may also be provided in a processor, for example, may be described as: a processor including a receiving unit, a decryption unit, a matching unit, a traffic monitoring unit, an anomaly detection unit, and a sending unit. The names of these units do not, in some cases, constitute limitations on the units themselves, for example, a receiving unit may also be described as a "unit for receiving bus messages to be processed".

[0113] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0114] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. A method for detecting abnormal messages, comprising: Receive encrypted bus message information to be processed; Decrypting the encrypted bus message to be processed to obtain the bus message to be processed and a message encryption random number; Matching the bus message to be processed with the preset whitelist rule information to obtain a matching result; In response to determining that the matching result satisfies a preset matching condition, based on the message encryption random number, performing flow monitoring processing on the bus message to be processed to obtain a flow monitoring result; In response to determining that the traffic monitoring result satisfies a preset traffic monitoring condition, inputting the bus message to be processed into a pre-trained message anomaly detection model to obtain an anomaly detection result; In response to determining that the abnormality detection result satisfies a preset abnormality detection condition, sending the bus message to be processed to a vehicle control terminal for controlling the vehicle; The encrypted bus message information to be processed is generated by the following steps: Generate initial encryption key, initial bus message and message encryption random number; The initial bus message and the message encryption random number are concatenated to obtain the message data to be encrypted, wherein the initial bus message and the message encryption random number are concatenated in the order of the message encryption random number first and the initial bus message later to obtain the message data to be encrypted; Performing expansion processing on the initial encryption key to obtain an encryption subkey sequence, wherein the initial encryption key is expanded using a preset expansion algorithm to obtain the encryption subkey sequence; For each encryption subkey in the encryption subkey sequence, perform the following encryption substeps: Performing XOR processing on the encryption subkey and the message data to be encrypted corresponding to the encryption subkey to obtain first encrypted message data; Performing substitution processing on the first encrypted message data to obtain second encrypted message data; Performing row shift processing on the second encrypted message data to obtain third encrypted message data, wherein the second encrypted message data is converted into an encrypted message matrix, the second row of the encrypted message matrix is ​​shifted left by one byte, the third row of the encrypted message matrix is ​​shifted left by two bytes, and the fourth row of the encrypted message matrix is ​​shifted left by three bytes; In response to determining that the encryption subkey satisfies a preset encryption condition, performing an XOR process on the third encrypted message data and the encryption subkey to obtain target encrypted message data, wherein the preset encryption condition is that the encryption subkey is the last encryption subkey in the encryption subkey sequence; Performing fusion processing on the target encrypted message data and the encryption subkey sequence to obtain the encrypted bus message information to be processed; In response to determining that the encryption subkey does not satisfy the preset encryption condition, determining the product of the third encrypted message data and a preset confusion matrix as fourth encrypted message data; performing an XOR process on the fourth encrypted message data and the encryption subkey to obtain fifth encrypted message data; The fifth encrypted message data is determined as the message data to be encrypted corresponding to the next encryption subkey of the encryption subkey.

2. The method according to claim 1, wherein: The method further comprises: In response to determining that the matching result does not satisfy the preset matching condition, discarding the bus message to be processed; In response to determining that the flow monitoring result does not meet the preset flow monitoring condition, performing the following processing steps: Discard pending bus messages; Disabling each bus message corresponding to the address information of the bus message to be processed included in the bus message to be processed; The first preset alarm information is sent to the vehicle alarm terminal for alarm processing; in response to determining that the abnormality detection result does not meet the preset abnormality detection condition, the bus message to be processed is discarded, and the second preset alarm information is sent to the vehicle alarm terminal for alarm processing.

3. The method according to claim 1, wherein: The bus message to be processed includes: a message timestamp and a message length value; and The method further comprises: Acquire a first bus message set within a preset unit time length before a message timestamp included in the bus message to be processed, wherein each first bus message in the first bus message set includes: a first bus message length value; Determine the sum of the first bus message length value included in each first bus message in the first bus message set and the message length value included in the bus message to be processed as the unit message data amount; In response to determining that the unit message data volume is greater than a preset data threshold, the vehicle bus network is shut down, and a third preset alarm information is sent to the vehicle alarm terminal for alarm processing.

4. The method according to claim 1, wherein: The bus message to be processed includes: address information of the bus message to be processed, and the preset whitelist rule information includes: a whitelist address information set and a message rule information set; and The matching process of the bus message to be processed with the preset whitelist rule information to obtain a matching result includes: In response to determining that there is whitelist address information identical to the to-be-processed bus message address information included in the to-be-processed bus message in the whitelist address information set included in the preset whitelist rule information, matching the to-be-processed bus message with each message rule information in the message rule information set included in the preset whitelist rule information to generate an initial message matching result, thereby obtaining an initial message matching result set; In response to determining that there is a message initial matching result that meets a preset initial matching condition in the message initial matching result set, first preset matching information is determined as the matching result.

5. The method according to claim 4, wherein: The method further comprises: In response to determining that there is no message initial matching result satisfying the preset initial matching condition in the message initial matching result set, second preset matching information is determined as the matching result.

6. The method according to claim 3, wherein: The process of performing flow monitoring processing on the bus message to be processed based on the message encryption random number to obtain a flow monitoring result includes: Acquire a second bus message set and an initial message encryption random number set within a preset time length before a message timestamp included in the bus message to be processed, wherein each second bus message in the second bus message set includes: second bus message address information, and the second bus messages in the second bus message set correspond one-to-one to the initial message encryption random numbers in the initial message encryption random number set; For each second bus message in the second bus message set, in response to determining that the second bus message address information included in the second bus message is the same as the to-be-processed bus message address information included in the to-be-processed bus message, determining the second bus message as a target bus message; In response to determining that the number of each target bus message is less than a preset message threshold and that there is no initial message encryption random number identical to the message encryption random number in the initial message encryption random number set, a first preset monitoring result is determined as the traffic monitoring result, and the message encryption random number is stored in a storage terminal.

7. The method according to claim 6, wherein: The method further comprises: In response to determining that the number of target bus messages in the determined target bus messages is greater than or equal to the preset message threshold, or that there is an initial message encryption random number identical to the message encryption random number in the initial message encryption random number set, a second preset monitoring result is determined as the traffic monitoring result.

8. An abnormal message detection device, comprising: A receiving unit, configured to receive encrypted bus message information to be processed; A decryption unit, configured to decrypt the encrypted bus message to be processed to obtain the bus message to be processed and a message encryption random number; A matching unit is configured to match the bus message to be processed with preset whitelist rule information to obtain a matching result; A flow monitoring unit, configured to, in response to determining that the matching result satisfies a preset matching condition, perform flow monitoring processing on the bus message to be processed based on the message encryption random number to obtain a flow monitoring result; an anomaly detection unit, configured to, in response to determining that the traffic monitoring result satisfies a preset traffic monitoring condition, input the to-be-processed bus message into a pre-trained message anomaly detection model to obtain an anomaly detection result; a sending unit, configured to send the to-be-processed bus message to a vehicle control terminal for controlling the vehicle in response to determining that the abnormality detection result satisfies a preset abnormality detection condition; The encrypted bus message information to be processed is generated by the following steps: Generate initial encryption key, initial bus message and message encryption random number; The initial bus message and the message encryption random number are concatenated to obtain the message data to be encrypted, wherein the initial bus message and the message encryption random number are concatenated in the order of the message encryption random number first and the initial bus message later to obtain the message data to be encrypted; Performing expansion processing on the initial encryption key to obtain an encryption subkey sequence, wherein the initial encryption key is expanded using a preset expansion algorithm to obtain the encryption subkey sequence; For each encryption subkey in the encryption subkey sequence, perform the following encryption substeps: Performing XOR processing on the encryption subkey and the message data to be encrypted corresponding to the encryption subkey to obtain first encrypted message data; Performing substitution processing on the first encrypted message data to obtain second encrypted message data; Performing row shift processing on the second encrypted message data to obtain third encrypted message data, wherein the second encrypted message data is converted into an encrypted message matrix, the second row of the encrypted message matrix is ​​shifted left by one byte, the third row of the encrypted message matrix is ​​shifted left by two bytes, and the fourth row of the encrypted message matrix is ​​shifted left by three bytes; In response to determining that the encryption subkey satisfies a preset encryption condition, performing an XOR process on the third encrypted message data and the encryption subkey to obtain target encrypted message data, wherein the preset encryption condition is that the encryption subkey is the last encryption subkey in the encryption subkey sequence; Performing fusion processing on the target encrypted message data and the encryption subkey sequence to obtain the encrypted bus message information to be processed; In response to determining that the encryption subkey does not satisfy the preset encryption condition, determining the product of the third encrypted message data and a preset confusion matrix as fourth encrypted message data; performing an XOR process on the fourth encrypted message data and the encryption subkey to obtain fifth encrypted message data; The fifth encrypted message data is determined as the message data to be encrypted corresponding to the next encryption subkey of the encryption subkey.

9. An electronic device, comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

10. A computer readable medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images