Abnormal message detection method, computer device and computer readable storage medium

Abstract

The application discloses an abnormal message detection method, a computer device and a computer readable storage medium. The abnormal message detection method comprises the following steps: creating a cache queue with a length of N; sequentially storing the obtained CAN messages into the cache queue according to time sequence; when the cache queue is full, marking the N CAN messages stored as a sequence, and obtaining the occurrence probability of the sequence; obtaining a preset lower limit boundary value and a preset upper limit boundary value; if the occurrence probability is less than the preset lower limit boundary value or greater than the preset upper limit boundary value, it is determined that there is an abnormal message in the sequence. The method can cover the interaction abnormality detection between messages, realize fast, comprehensive and accurate detection of the messages, and has the advantages of simplicity, low cost, simultaneous safety monitoring of multiple messages, breaking through the limitation of the number of continuous message detection, and effectively improving the safety and stability of the system.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of vehicle network security, and particularly relates to an abnormal message detection method, a computer device and a computer readable storage medium. BACKGROUND

[0002] With the rapid development of Internet of Vehicles technology, network security problems of vehicles have become increasingly prominent and have become the focus of attention of major automobile manufacturers. In modern vehicle network systems, it is crucial to ensure the security and reliability of data communication. With the increasing complexity and electronicization of vehicle functions, the controller area network (CAN) inside the vehicle carries a large amount of data exchange tasks. These data exchanges usually involve communication between multiple electronic control units (ECUs), which achieve information transmission by sending and receiving CAN messages. However, as the security threats faced by vehicle networks increase, how to effectively detect and prevent potential abnormal messages has become a problem to be solved.

[0003] Traditional anomaly detection methods often focus on feature analysis of a single message, such as message frequency, content mode, etc., and ignore the timing relationship and transition mode between messages. Such methods often fail to effectively identify complex attack patterns, such as abnormal changes in continuous message patterns. In addition, existing detection techniques usually need to configure specific detection rules for each CANID message, which not only increases the complexity of the system, but also makes it difficult to adapt to dynamically changing network environments. SUMMARY

[0004] Therefore, the embodiments of the present disclosure provide an abnormal message detection method, a computer device and a computer readable storage medium, which can solve the problems of single, incomplete, low recognition accuracy and inability to cover interaction anomaly detection between messages of the existing message anomaly detection method.

[0005] In a first aspect, the embodiments of the present disclosure provide an abnormal message detection method, which adopts the following technical scheme:

[0006] create a cache queue with a length of N;

[0007] store the obtained CAN messages in the cache queue in time sequence;

[0008] when the cache queue is full, mark the N CAN messages stored as a sequence, and obtain the occurrence probability of the sequence;

[0009] obtain a preset lower limit boundary value and a preset upper limit boundary value;

[0010] If the occurrence probability is less than the preset lower boundary value or greater than the preset upper boundary value, it is determined that the sequence has an abnormal message;

[0011] N≥2.

[0012] Optionally, the obtaining of the occurrence probability of the sequence comprises:

[0013] obtaining ID conversion probabilities of all adjacent two CAN messages;

[0014] multiplying the P ID conversion probabilities to obtain the occurrence probability;

[0015] P=N-1.

[0016] Optionally, the obtaining of the ID conversion probabilities of all adjacent two CAN messages comprises:

[0017] determining two ID values of adjacent two CAN messages, and marking an ID value of a first message as ID1 and an ID value of a second message as ID2;

[0018] obtaining an ID conversion probability from the ID1 to the ID2 based on the constructed message conversion probability matrix.

[0019] Optionally, the method for constructing the message conversion probability matrix comprises:

[0020] obtaining a sample set containing all different preset types of messages;

[0021] the sample set is traffic data on a CAN bus in a running process of a vehicle in a preset period;

[0022] obtaining a CANID value set of the sample set;

[0023] marking two adjacent message IDs in the CANID value set as a group of ID information;

[0024] obtaining a sample conversion probability Y of each group of ID information i ;

[0025] obtaining all different CANID values in the CANID value set and marking them as a first set;

[0026] arranging the CANID values in the first set in ascending order to obtain a matrix first row index and a matrix first column index;

[0027] constructing the message conversion probability matrix based on the matrix first row index, the matrix first column index, and the sample conversion probability Y of each group of ID information;

[0028] The number of rows and columns of the message conversion probability matrix is K, K=T+1; wherein, T is the number of all different CANID values in the CANID value set.

[0029] Optionally, the sample conversion probability is Y i , Y i =(S i +1 / S i+1 +1)×100%;

[0030] Wherein, S i is the group number of other ID information in the sample set that is the same as the ID of the first message in the ID information, S i+1 is the group number of other ID information in the sample set that is the same as the ID information;

[0031] The ID information is the i-th group, 0

[0032] Optionally, the method further comprises:

[0033] Calculating the event occurrence probability of the continuous N adjacent CAN messages in the sample set;

[0034] Taking the minimum value of the obtained event occurrence probability as the preset lower boundary value;

[0035] Taking the maximum value of the obtained event occurrence probability as the preset upper boundary value.

[0036] Optionally, the method further comprises:

[0037] Initializing a sliding window with a size of N;

[0038] Obtaining P sample conversion probabilities between two adjacent message IDs in the current sliding window based on the constructed message conversion probability matrix;

[0039] Multiplying the obtained P sample conversion probabilities to obtain the event occurrence probability of the current sliding window;

[0040] Sliding the sliding window on the sample set to obtain all event occurrence probabilities in the sample set;

[0041] The sliding step of the sliding window is one message position, and the sliding window covers N adjacent CAN messages.

[0042] Optionally, the method further comprises:

[0043] when the Rth CAN message is received, deleting the earliest received stored CAN message in the cache queue;

[0044] storing the Rth CAN message in the cache queue in time sequence to obtain a new cache queue;

[0045] wherein, R=N+1.

[0046] In a second aspect, the embodiments of the present disclosure further provide an abnormal message detection system, which adopts the following technical scheme:

[0047] a creating module configured to create a cache queue with a length of N; N≥2;

[0048] a storing module configured to store the obtained CAN messages in the cache queue in time sequence;

[0049] a calculating module configured to, when the cache queue is full, mark the N stored CAN messages as a sequence, and obtain an occurrence probability of the sequence;

[0050] an obtaining module configured to obtain a preset lower limit boundary value and a preset upper limit boundary value;

[0051] a judging module configured to determine that there is an abnormal message in the sequence if the occurrence probability is less than the preset lower limit boundary value or greater than the preset upper limit boundary value.

[0052] In a third aspect, the embodiments of the present disclosure further provide a computer device, which adopts the following technical scheme:

[0053] The computer device comprises:

[0054] at least one processor; and

[0055] a memory in communication connection with the at least one processor; wherein

[0056] the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any one of the above abnormal message detection methods.

[0057] In a fourth aspect, the embodiments of the present disclosure further provide a computer readable storage medium, which stores computer instructions for causing a computer to execute any one of the above abnormal message detection methods.

[0058] In a fifth aspect, the embodiments of the present disclosure further provide a computer program product, which comprises computer programs / instructions, and the computer programs / instructions are executed by a processor to implement the steps of any one of the above methods.

[0059] The abnormal message detection method disclosed in the application can store the received CAN messages to be detected in order through the created cache queue, guarantee the time sequence of the CAN messages, analyze the continuous multiple messages as a whole sequence, identify the potential abnormal messages by evaluating the occurrence probability of the sequence, and not only can quickly and accurately detect the abnormal messages, but also considers the mutual correlation between the messages, and can cover the interactive abnormal detection between the messages. Meanwhile, the method is simple and easy to implement, low in cost, can simultaneously perform safety monitoring on multiple messages, breaks through the limitation on the number of continuous message detection, and through the disclosed scheme, the safety and stability of the system can be effectively improved.

[0060] The above description is only a summary of the technical scheme of the disclosure, in order to more clearly understand the technical means of the disclosure, the content of the specification can be implemented, and in order to make the above and other purposes, characteristics and advantages of the disclosure more obvious and easy to understand, the following preferred embodiments are described in detail below, and the accompanying drawings are described as follows. BRIEF DESCRIPTION OF DRAWINGS

[0061] In order to more clearly illustrate the technical scheme of the embodiments of the disclosure, the following will briefly introduce the drawings needed to be used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the disclosure, and those skilled in the art can obtain other drawings according to these drawings without creating any creative labor.

[0062] Figure 1 The flowchart of the abnormal message detection method provided by the embodiments of the disclosure.

[0063] Figure 2 The flowchart of the sequence occurrence probability acquisition method. Figure 1

[0064] The flowchart of the ID conversion probability acquisition method of the adjacent two CAN messages. Figure 3 Figure 2 The flowchart of the message conversion probability matrix construction method.

[0065] Figure 4 Figure 3 The flowchart of the boundary value acquisition method.

[0066] Figure 5 The flowchart of the event occurrence probability acquisition method. Figure 4

[0067] Figure 6 The flowchart of the event occurrence probability acquisition method. Figure 5

[0068] Figure 7 ​​​​A principle block diagram of an abnormal packet detection system provided by an embodiment of the present disclosure.

[0069] Figure 8 A structural schematic diagram of a computer device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0070] The embodiments of the present disclosure will be described in detail below with reference to the drawings.

[0071] It should be apparent that the following describes embodiments of this disclosure by way of specific examples, and that one skilled in the art could readily derive further advantages and effects from this disclosure. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and are not all the embodiments. This disclosure can also be implemented or applied by different specific embodiments, and the details in this specification can be modified or changed based on different views and applications without departing from the spirit of this disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in this disclosure, all other embodiments obtained by one of ordinary skill in the art without creative labor are within the scope of protection of this disclosure.

[0072] It should be noted that the various aspects of the embodiments described below are within the scope of the appended claims. It should be apparent that the aspects described herein can be embodied in a wide variety of forms and that any specific structure and / or function described herein is merely illustrative. Based on the teachings provided herein one skilled in the art will appreciate that one aspect described herein can be implemented independently of any other aspects and that the various aspects described herein can be combined in various ways. For example, an apparatus can be implemented or a method can be practiced using any number of the aspects set forth herein. In addition, such an apparatus can be implemented or such a method can be practiced using other structure and / or functionality in addition to or other than one or more of the aspects set forth herein.

[0073] It should also be noted that the drawings provided in the following embodiments are only to illustrate the basic concept of the present disclosure, and only show the components related to the present disclosure in the drawings, not drawn according to the number, shape and size of the components in actual implementation, and the shape, number and ratio of each component in actual implementation can be arbitrarily changed, and the layout pattern of the components can be more complex.

[0074] In addition, in the following description, specific details are provided to facilitate a thorough understanding of the examples. One skilled in the art will understand, however, that the described aspects can be practiced without these specific details.

[0075] Reference Figure 1The first aspect of the application discloses an abnormal message detection method, which comprises the following steps:

[0076] S100, creating a cache queue;

[0077] The length of the cache queue is N.

[0078] Wherein, N≥2.

[0079] In this step, the cache queue created facilitates subsequent processing and analysis.

[0080] S200, sequentially storing the acquired CAN messages in the cache queue according to time sequence.

[0081] In this step, storing the CAN messages according to time sequence can ensure the time sequence of data, that is, the receiving time of each message can be accurately recorded, which is conducive to subsequent analysis and judgment of the occurrence regularity of the message; by storing the CAN messages in order, the correlation and regularity between the messages can be more accurately judged, thereby improving the detection accuracy of abnormal messages and reducing the possibility of misjudgment; storing the CAN messages according to time sequence can reduce the complexity of data processing, optimize the algorithm performance, and improve the operation efficiency and stability of the system.

[0082] S300, when the cache queue is full, marking the stored N CAN messages as a sequence, and acquiring the occurrence probability of the sequence.

[0083] In this step, the stored N CAN messages are consecutive N CAN messages, and the N CAN messages are analyzed as a sequence, covering the correlation between the messages, which is different from the analysis of a single message in the prior art. This scheme can be more comprehensive and accurate, ensuring that the judgment of abnormal messages is more objective and accurate, effectively reducing the probability of false positives and avoiding misjudgment of normal messages.

[0084] S400, acquiring a preset lower limit boundary value and a preset upper limit boundary value.

[0085] S500, judging whether the occurrence probability is less than the preset lower limit boundary value or greater than the preset upper limit boundary value, if so, determining that there is an abnormal message in the sequence.

[0086] In this step, by setting the preset lower limit and upper limit boundary values, the determination standard of abnormal messages can be clearly defined, so that the identification process of abnormal messages becomes more accurate and certain, improving the reliability of detection; by determining through the preset boundary values, the automatic identification of abnormal messages can be realized, reducing the cost and time of manual judgment and improving the efficiency and accuracy of the system; once an abnormal message is found in the sequence, the system can immediately respond and process, timely eliminating abnormal factors, enhancing the real-time performance and flexibility of the system.

[0087] The abnormal message detection method disclosed in the application can store the received CAN messages to be detected in order through the created cache queue, guarantee the time sequence of the CAN messages, analyze the continuous multiple messages as a whole sequence, identify the potential abnormal messages by evaluating the occurrence probability of the sequence, and not only can quickly and accurately detect the abnormal messages, but also considers the mutual correlation between the messages, and can cover the interactive abnormal detection between the messages. Meanwhile, the method is simple and easy to implement, low in cost, can simultaneously perform safety monitoring on multiple messages, breaks through the limitation on the number of continuous message detection, and through the disclosed scheme, the safety and stability of the system can be effectively improved.

[0088] It should be noted that the steps of obtaining the preset lower limit boundary value and the preset upper limit boundary value can be placed at any position before the judgment on the occurrence probability, and the specific steps given in the embodiment do not limit the protection scope of the application, and therefore will not be described here.

[0089] Referring to Figure 2 , the method for obtaining the occurrence probability of the sequence specifically includes the following steps:

[0090] S310, obtaining the ID conversion probability of all adjacent two CAN messages;

[0091] S320, multiplying the obtained P ID conversion probabilities to obtain the occurrence probability;

[0092] P = N-1.

[0093] In the embodiment, by obtaining the ID conversion probability of the adjacent two CAN messages, the conversion rule between each pair of messages can be accurately analyzed, so that the occurrence probability of the whole sequence can be more accurately calculated, and the accuracy and reliability of the statistical result are improved; the P ID conversion probabilities are multiplied to obtain the occurrence probability of the whole sequence, which can simplify the calculation process, reduce the complexity and time of the calculation, and improve the efficiency of the data processing.

[0094] The scheme can be applied to different CAN message sequences by calculating the ID conversion probability of the adjacent messages, has strong universality and scalability, and is suitable for processing and analyzing various CAN message data.

[0095] By multiplying the ID conversion probabilities between multiple adjacent messages to calculate the occurrence probability of the whole sequence, the comprehensive influence of multiple conversion rules is considered, which is helpful for comprehensively analyzing the abnormal conditions in the sequence.

[0096] Referring to Figure 3 , the method for obtaining the ID conversion probability of the adjacent two CAN messages specifically includes the following steps:

[0097] S311, determine the two ID values of the two adjacent CAN messages, and mark the ID value of the first message in the two adjacent CAN messages as ID1 and the ID value of the second message as ID2;

[0098] S312, obtain the ID conversion probability from ID1 to ID2 based on the constructed message conversion probability matrix.

[0099] In this embodiment, by determining the ID values of the two adjacent CAN messages and obtaining the conversion probability from ID1 to ID2 based on the message conversion probability matrix, the fine-grained analysis of the conversion behavior between each pair of adjacent messages can be realized; the method of obtaining the conversion probability from ID1 to ID2 by using the message conversion probability matrix can realize efficient data analysis and processing process, and has strong flexibility, which can flexibly adjust the analysis parameters and model according to the specific needs, and meet the application needs of different scenes; by analyzing the ID conversion probability of the two adjacent CAN messages, the dimension and complexity of the data can be controlled, important information and rules can be effectively extracted, and the difficulty of analysis caused by too much redundant data can be avoided, which is helpful to deeply mine the internal rules and characteristics of the data.

[0100] Reference Figure 4 , the construction method of the message conversion probability matrix specifically includes the following steps:

[0101] A100, obtaining a sample set containing all different preset type messages;

[0102] The sample set is the flow data on the CAN bus of the vehicle during the running process in a preset period.

[0103] Specifically, the sample set includes all CANID values of the adapted scene, ensuring that the constructed message conversion probability matrix is comprehensive and accurate, and the sample set has wide representativeness.

[0104] In this embodiment, the collection of the sample set is preferably achieved by connecting the OBD interface or in-vehicle gateway device of the vehicle using hardware tools such as VN1640 or USBCAN-4E-U, and using software such as CANOE or ZCANPRO as the host computer to capture the data flow on the CAN bus.

[0105] A200, obtaining a CANID value set of the sample set.

[0106] A300, marking the message IDs in the CANID value set as a group of ID information;

[0107] Obtaining the sample conversion probability Y of each group of ID information i .

[0108] In this step, the sample conversion probability between all adjacent message IDs in the CAN ID value set can be obtained.

[0109] The sample conversion probability Y of each group of ID information i are the probabilities of the ID of the first message converting to the ID of the second message.

[0110] A400, all different CAN ID values in the CAN ID value set are obtained and marked as a first set;

[0111] The CAN ID values in the first set are arranged in ascending order to obtain the matrix first row index and the matrix first column index.

[0112] In this step, the arranged CAN ID values are obtained as the matrix first row index and the matrix first column index, that is, the matrix first column index and the matrix first row index are set to be the same.

[0113] A500, based on the matrix first row index, the matrix first column index, and the sample conversion probability of each group of ID information, a message conversion probability matrix is constructed;

[0114] Specifically, the number of rows and the number of columns of the message conversion probability matrix are both K, K=T+1; wherein T is the number of all different CAN ID values in the CAN ID value set.

[0115] In the message conversion probability matrix, T 2 sample conversion probabilities are contained.

[0116] In this embodiment, by obtaining a sample set containing all different preset type messages and constructing a message conversion probability matrix, the traffic data on the entire CAN bus can be comprehensively analyzed, and the conversion rules between various messages can be fully grasped; based on the CAN ID value set of the sample set, adjacent message IDs are marked as a group of ID information, and a probability matrix is constructed according to the sample conversion probability of each group of ID information, which can accurately reflect the conversion probability between different IDs, thereby improving the accuracy and reliability of data analysis; according to the CAN ID value set, a message conversion probability matrix is constructed, and the CAN ID values are arranged in a specified order, which can clearly show the conversion rules between different IDs, help users intuitively understand the relevance between messages, and improve the intuitiveness and visualization effect of data analysis; by constructing the message conversion probability matrix, a large amount of CAN bus traffic data can be quickly and effectively integrated and processed according to the setting of the number of rows and the number of columns, the conversion probability between different IDs can be intuitively presented, and users can more intuitively understand the conversion rules between CAN messages.

[0117] Specifically, the sample conversion probability is Y i , Y i= (S i + 1 / S i+1 + 1) x 100%.

[0118] Wherein, S i is the group number of other ID information in the sample set which is same as the ID of the first message in the ID information, S i+1 is the group number of other ID information in the sample set which is same as the ID information.

[0119] ID information is the i-th group, 0 < i ≤ Q-1, Q is the number of messages in the sample set.

[0120] Specifically, if the ID information is W1, and W1 is ID1, ID2, then the group number of all ID information in the sample set whose first message is ID1 is inquired, that is, S i + 1; then the group number of all ID information in the sample set whose first message is ID1 and second message is ID2 is inquired, that is, S i+1 + 1, so that the probability of ID1 converting to ID2, that is, the sample conversion probability of the corresponding sample, can be obtained.

[0121] Further, in the preset period, the vehicle performs all operations to ensure that the obtained sample set is comprehensive and reliable.

[0122] It should be noted that, in the present application, the "ID conversion probability from ID1 to ID2 based on the constructed message conversion probability matrix" is specifically the sample conversion probability of (ID1, ID2) found from the constructed message conversion probability matrix, as the actual ID conversion probability from ID1 to ID2.

[0123] Referring to Figure 5 , the method for obtaining the boundary value (i.e. the preset lower boundary value, the preset upper boundary value) specifically includes the following steps:

[0124] B100, calculating the event occurrence probability of the consecutive N adjacent CAN messages in the sample set;

[0125] B200, taking the minimum value in the obtained event occurrence probability as the preset lower boundary value;

[0126] taking the maximum value in the obtained event occurrence probability as the preset upper boundary value.

[0127] In this embodiment, by calculating the event occurrence probability of the continuous N adjacent CAN messages in the sample set, a group of event occurrence probabilities can be obtained, and the minimum value thereof is taken as the preset lower boundary value and the maximum value is taken as the preset upper boundary value, so that the abnormal value range of the data can be clearly defined, which is beneficial to distinguish abnormal conditions and normal data, helps users to better identify and handle potential problems; the preset lower boundary value and the upper boundary value are obtained based on the actual event occurrence probability, which can more objectively and accurately reflect the change range of the data, and is beneficial to optimize the analysis model and parameter setting, by setting reasonable boundary values, the possibility of misjudgment and false alarm can be reduced, and the accuracy and stability of data analysis can be improved; the boundary value acquisition method is based on the event occurrence probability in the sample set, which considers the distribution and volatility of the data, so that the boundary value is more representative and robust. In actual application, the boundary value can be flexibly adjusted according to actual situation to meet different needs and improve the adaptability and reliability of the system; by taking the minimum value and the maximum value as the preset lower boundary value and the upper boundary value, the range of the data is determined simply and clearly, which is easy to understand and apply. Users can intuitively judge the abnormal condition of the data through the setting of the boundary value, quickly respond and take corresponding measures, and improve the efficiency and practicability of data analysis.

[0128] With reference to Figure 6 The event occurrence probability acquisition method specifically includes the following steps:

[0129] B110, initializing a sliding window; the size of the sliding window is N.

[0130] Specifically, a sliding window with a size of N is created to calculate the event occurrence probability of the continuous N CAN messages.

[0131] B120, obtaining P sample transition probabilities between the adjacent two message IDs in the current sliding window based on the constructed message transition probability matrix.

[0132] Specifically, according to the current position of the sliding window, the message information in the current sliding window is obtained, and then the P sample transition probabilities between the adjacent two message IDs in the current sliding window can be directly obtained in the constructed message transition probability matrix.

[0133] B130, multiplying the obtained P sample transition probabilities to obtain the event occurrence probability of the current sliding window.

[0134] Specifically, the event occurrence probability in the current sliding window is the product of all sample transition probabilities in the current sliding window.

[0135] B140, sliding the sliding window on the sample set to obtain all event occurrence probabilities in the sample set;

[0136] The sliding step of the sliding window is one message position, and the sliding window covers N adjacent CAN messages.

[0137] Specifically, the sliding window moves back one message position each time, and the probability calculation is only performed when the window always contains N complete messages; if the window cannot completely cover N messages after sliding, further sliding is stopped, and the probability statistics end.

[0138] Further, based on the constructed message transition probability matrix, the sample transition probability between the IDs of two adjacent messages in the current sliding window is obtained, and the event occurrence probability in the current sliding window is the product of all sample transition probabilities in the current sliding window.

[0139] Then, according to each movement of the sliding window, the corresponding event occurrence probability is calculated, and thus all event occurrence probabilities in the sample set can be obtained.

[0140] For example, when N is 4, if the messages in the current sliding window are message 1, message 2, message 3, and message 4, and it is known that the ID value of message 1 is ID3, the ID value of message 2 is ID1, the ID value of message 3 is ID2, and the ID value of message 4 is ID4, the sample transition probabilities Y i (ID3, ID1), Y i (ID1, ID2), Y i (ID2, ID4) can be directly obtained in the constructed message transition probability matrix, and then the event occurrence probability in the current sliding window is the product of the three sample transition probabilities.

[0141] In this embodiment, by initializing the sliding window, sliding on the sample set, and obtaining the event occurrence probability, real-time monitoring and detection of event occurrence can be realized. Using the sliding window method, the probability change of event occurrence in different time periods in the sample set can be dynamically tracked, effectively reflecting the real-time situation of the data. If the size and step length of the sliding window are reasonably set, all events in the sample set can be covered, and complete event occurrence probabilities can be obtained. By comprehensively covering the sample set, the change trend and law of event occurrence can be effectively captured, and the comprehensiveness and accuracy of data analysis can be improved. By adjusting the size and step length of the sliding window, the granularity and time span of the event occurrence probability can be flexibly controlled. According to specific needs, the window parameters can be adjusted to realize monitoring and analysis of event probabilities under different time scales, which is beneficial to customized data processing and analysis models. Using the method of sliding the sliding window on the sample set to obtain the event occurrence probability, real-time monitoring and analysis of data can be realized. By monitoring the probability of event occurrence in real time, abnormal situations and change trends of data can be discovered in time, providing an important reference for monitoring and adjusting the system running state.

[0142] Therefore, the event occurrence probability acquisition method has the advantages of dynamic real-time, comprehensive coverage, parameter flexibility, and real-time data monitoring, which helps to deeply analyze data characteristics and rules, and improves the effect and efficiency of abnormal detection and data monitoring.

[0143] Further, the abnormal message detection method disclosed in the application further comprises:

[0144] When the Rth CAN message is received (i.e., when the buffer queue is full), the earliest received and stored CAN message in the buffer queue is deleted;

[0145] The Rth CAN message is stored in the buffer queue in chronological order to obtain a new buffer queue;

[0146] Then, the new buffer queue is taken as a sequence, the occurrence probability of the sequence is acquired, and the occurrence probability is compared with the preset lower limit boundary value and the preset upper limit boundary value, so as to determine whether there is an abnormal message in the sequence.

[0147] Wherein, R=N+1.

[0148] For example, when the full buffer queue is ABCD, a new message E is received, and after the earliest received and stored CAN message is deleted and the new message is stored, the new buffer queue obtained is BCDE.

[0149] In this embodiment, by deleting the earliest stored CAN message at a fixed time and updating the buffer queue in real time, the data in the buffer queue can always be synchronized with the latest received CAN message, so that the latest message sequence can be monitored in time, and the detection of abnormal messages has real-time and accuracy, and abnormal situations can be found and handled in time; the new buffer queue is taken as a sequence, the occurrence probability of the sequence is acquired, and the occurrence probability is compared with the preset lower limit boundary value and the upper limit boundary value, so as to effectively determine whether there is an abnormal message in the sequence. This method combines sequence probability analysis and boundary value comparison, can efficiently detect abnormal messages, improve the effectiveness and efficiency of detection, and reduce the possibility of false positives and false negatives; by comparing the sequence occurrence probability with the preset boundary value, automatic abnormal detection can be realized, the complexity of manual intervention and operation is reduced, the system can automatically determine the existence of abnormal messages according to the set rules, and timely alarm or corresponding processing measures are taken, which improves the automation degree and efficiency of data processing.

[0150] In summary, the abnormal message detection method has the advantages of real-time and accuracy, effectiveness and efficiency, parameter adjustability and automatic abnormal detection, which helps to capture abnormal messages in time and ensure the stability and reliability of the system.

[0151] Further, the abnormal message detection method disclosed in the application further comprises: when it is determined that there is an abnormal message in a sequence, analyzing whether a combination (i.e., ID information) with a sample conversion probability of 0 appears in the sequence; if such a case appears in the abnormal sequence, it is directly determined that both messages in the ID information with the sample conversion probability of 0 are abnormal messages.

[0152] Alternatively, the message sequence can also be recorded through an alarm log, and a security personnel needs to further analyze the abnormal reason.

[0153] The abnormal message detection method disclosed in the application aims to be integrated into a CAN intrusion detection system (IDS) or an intrusion protection system (IPS) in a vehicle-mounted gateway or an ECU device, expand the function of a detection engine, and enhance the identification capability of the message sequence abnormality.

[0154] Specifically, a message sequence abnormality detection function can be added in an existing CAN intrusion detection system (IDS) or an intrusion protection system (IPS). Abnormal messages are injected into the detection engine provided with the application by using CANOE or ZCANPRO as an upper computer tool, and alarm logs generated by the detection engine can be seen.

[0155] With reference to Figure 7 , the second aspect further provides an abnormal message detection system, which adopts the following technical scheme:

[0156] The creating module is configured to create a cache queue; and the length of the cache queue is N.

[0157] N≥2;

[0158] The storage module is configured to store the obtained CAN messages in the cache queue in time sequence.

[0159] The calculation module is configured to, when the cache queue is full, mark N CAN messages stored in the cache queue as a sequence, and obtain the occurrence probability of the sequence.

[0160] The obtaining module is configured to obtain a preset lower limit boundary value and a preset upper limit boundary value.

[0161] The judgment module is configured to determine that there is an abnormal message in the sequence if the occurrence probability is less than the preset lower limit boundary value or greater than the preset upper limit boundary value.

[0162] A computer device according to an embodiment of the present disclosure includes a memory and a processor. The memory is configured to store non-transitory computer readable instructions. Specifically, the memory can include one or more computer program products, which can include various forms of computer readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM), cache memory, and / or the like. The non-volatile memory may, for example, include read-only memory (ROM), hard disk, flash memory, and / or the like.

[0163] The processor can be a central processing unit (CPU) or other form of processing unit that has data processing and / or instruction execution capabilities, and can control other components in the computer device to perform desired functions. In one embodiment of the present disclosure, the processor is configured to execute the computer readable instructions stored in the memory, so that the computer device performs all or part of the steps of the anomaly packet detection method according to the embodiments of the present disclosure.

[0164] Those skilled in the art will understand that, in order to solve the technical problem of how to obtain a good user experience effect, the present embodiment can also include well-known structures such as a communication bus, an interface, and the like, which should also be included in the protection scope of the present disclosure.

[0165] As shown in Figure 8 A structural schematic diagram of a computer device according to an embodiment of the present disclosure is shown. It shows a structural schematic diagram suitable for implementing the computer device in the embodiments of the present disclosure. Figure 8 The computer device shown is merely an example and should not impose any limitation on the functions and use range of the embodiments of the present disclosure.

[0166] As shown in Figure 8 As shown, the computer device can include a processor (such as a central processing unit, a graphics processing unit, and the like), which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) or loaded into a random access memory (RAM) from a storage device. In the RAM, various programs and data required for the operation of the computer device are also stored. The processor, the ROM, and the RAM are connected to each other through a bus. An input / output (I / O) interface is also connected to the bus.

[0167] Generally, the following devices can be connected to the I / O interface: input devices including, for example, sensors or visual information acquisition devices; output devices including, for example, display screens; storage devices including, for example, magnetic tapes, hard disks, and the like; and communication devices. The communication devices can allow the computer device to communicate with other devices (such as edge computing devices) wirelessly or by wire to exchange data. Although Figure 8The computer device is shown with various devices, but it is understood that not all of the shown devices are required to be implemented or present. More or fewer devices can alternatively be implemented or present.

[0168] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processor, all or part of the steps of the anomaly packet detection method of the embodiments of the present disclosure are performed.

[0169] Detailed descriptions of the present embodiments can refer to the corresponding descriptions of the previous embodiments, which will not be repeated here.

[0170] The computer-readable storage medium according to the embodiments of the present disclosure has non-transitory computer-readable instructions stored thereon. When the non-transitory computer-readable instructions are run by a processor, all or part of the steps of the anomaly packet detection method of the embodiments of the present disclosure described above are performed.

[0171] The computer-readable storage medium described above includes, but is not limited to, optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or mobile hard disk), media with built-in rewritable non-volatile memory (e.g., memory card), and media with built-in ROM (e.g., ROM cartridge).

[0172] Detailed descriptions of the present embodiments can refer to the corresponding descriptions of the previous embodiments, which will not be repeated here.

[0173] The basic principles of the present disclosure are described above in combination with specific embodiments, but it should be noted that the advantages, advantages, effects, etc. mentioned in the present disclosure are only examples and are not limiting, and these advantages, advantages, effects, etc. cannot be considered as the must-have of each embodiment of the present disclosure. In addition, the above specific details are only for the purpose of example and for the purpose of understanding, and are not limiting, and the above details do not limit the present disclosure to the above specific details.

[0174] In this disclosure, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. The block diagram of the devices, apparatus, equipment, systems referred to in this disclosure is merely illustrative and not intended to imply the necessity or arrangement of the connections, arrangement, configuration as shown in the block diagram. As will be appreciated by those skilled in the art, the devices, apparatus, equipment, systems can be connected, arranged, configured in any manner. The words comprising, including, having and the like are to be open ended. As used in this document, the conjunction "or" is to be interpreted in the inclusive sense, i.e. as meaning one or the other, or both. As used in this document, the words "and" and "or" are to be interpreted as having the meaning indicated in the phrase "and / or". As used in this document, the word "such as" is to be interpreted as meaning "such as, but not limited to".

[0175] Also, as used in this document, the word "or" in the cases used to introduce an enumeration of several items, for example, a list of items, is to be interpreted in the inclusive sense, i.e. as meaning one or more, or any combination thereof, of the listed items. Additionally, the phrase "example of" as used in this document is not meant to be limiting in any way.

[0176] It is also important to note that the systems and methods of the present disclosure can be embodied in a variety of forms without departing from the spirit or essential characteristics thereof. Likewise, the disclosure is to be understood to include any alterations, modifications, revisions, or equivalent arrangements not herewith expressly disclosed but which are within the scope and spirit of the present disclosure.

[0177] Various changes, modifications and alterations in the teachings and techniques described herein can be made without departing from the teachings and techniques defined by the appended claims. Moreover, the scope of the claims of this disclosure is not limited to the specific aspects described above. Processes, machines, manufacture, compositions of matter, means, methods, or steps, presently existing or later to be developed that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Accordingly, the appended claims include within their scope such processes, machines, manufacture, compositions of matter, means, methods, or steps.

[0178] The above description of the disclosed aspects is meant to be illustrative only and not limiting as to the scope of the disclosure. Many variations of these aspects are possible which lay within the concepts of the disclosure defined by the scope of the appended claims as long as the steps are performed in substantial conformance with the educational aspects of the disclosure. Changes can be made, combinations can be made, components can be replaced, and the like without departing from the spirit of the disclosure and the scope of the appended claims. Accordingly, the disclosure is not intended to be limited to the aspects shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0179] The foregoing description has been presented for the purposes of illustration and description. Furthermore, the description is not intended to limit the embodiments of the disclosure to the forms disclosed herein. Although the various example aspects and embodiments have been described herein with regard to particular aspects and embodiments, those skilled in the art will recognize that certain modifications, changes, substitutions, additions and sub-combinations can be made without departing from the spirit of the disclosure.

Claims

1. An abnormal packet detection method, characterized in that, The method comprises: creating a cache queue with a length of N; storing the obtained CAN messages in the cache queue in chronological order; when the cache queue is full, marking the N CAN messages stored in the cache queue as a sequence, and obtaining a probability of occurrence of the sequence; obtaining a preset lower boundary value and a preset upper boundary value; if the probability of occurrence is less than the preset lower boundary value or greater than the preset upper boundary value, determining that there is an abnormal message in the sequence; wherein N≥2; the obtaining of the probability of occurrence of the sequence comprises: obtaining an ID conversion probability of all adjacent two CAN messages; multiplying the obtained P ID conversion probabilities to obtain the probability of occurrence; P=N-1; the obtaining of the ID conversion probability of all adjacent two CAN messages comprises: determining two ID values of adjacent two CAN messages, and marking the ID value of the first message as ID1 and the ID value of the second message as ID2; obtaining the ID conversion probability from ID1 to ID2 based on a constructed message conversion probability matrix; The method for constructing the message conversion probability matrix comprises: obtaining a sample set containing all different preset type messages; the sample set comprises traffic data on a CAN bus during running of a vehicle in a preset period; obtaining a CAN ID value set of the sample set; marking two adjacent message IDs in the CAN ID value set as a group of ID information; obtaining a sample conversion probability Y of each group of ID information i ; obtaining all different CAN ID values in the CAN ID value set and marking them as a first set; arranging the CAN ID values in the first set in ascending order to obtain a matrix first row index and a matrix first column index; and constructing the message conversion probability matrix based on the matrix first row index, the matrix first column index and the sample conversion probability of each group of ID information; the number of rows and the number of columns of the message conversion probability matrix are both K, K=T+1; wherein T is the number of all different CAN ID values in the CAN ID value set. The sample transition probability is Y. i Y i =(S i +1 / S i+1 +1) × 100%; where S i S is the number of other ID information groups in the sample set that have the same ID as the first message in the ID information. i+1 The number of other ID information groups in the sample set that are the same as the ID information; the ID information is the i-th group, 0 < i ≤ Q-1, and Q is the number of messages in the sample set.

2. The method of claim 1, wherein, the obtaining of the preset lower boundary value and the preset upper boundary value comprises: calculating an event occurrence probability of continuous N adjacent CAN messages in the sample set; taking the minimum value in the obtained event occurrence probability as the preset lower boundary value; taking the maximum value in the obtained event occurrence probability as the preset upper boundary value.

3. The method of claim 2, wherein, the calculation of the event occurrence probability of continuous N adjacent CAN messages in the sample set comprises: initializing a sliding window with a size of N; obtaining P sample conversion probabilities between adjacent two message IDs in the current sliding window based on the constructed message conversion probability matrix; multiplying the obtained P sample conversion probabilities to obtain an event occurrence probability of the current sliding window; sliding the sliding window on the sample set to obtain all event occurrence probabilities in the sample set; the sliding step of the sliding window is one message position, and the sliding window covers N adjacent CAN messages.

4. The method of any of claims 1-3, wherein, The abnormal message detection method further comprises: when the Rth CAN message is received, deleting the earliest received and stored CAN message in the cache queue; storing the Rth CAN message in the cache queue in chronological order to obtain a new cache queue; wherein R=N+1.

5. A computer apparatus, characterized by The computer device comprises: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the abnormal message detection method of claim 4.

6. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing a computer to execute the abnormal message detection method of claim 4.

Images