A method, system and computer storage medium for defending against automobile terminal attacks based on zero trust mechanism

Abstract

The present invention provides a vehicle terminal attack defense method, system and computer storage medium based on a zero-trust mechanism, which relate to the field of information security technology. A receiver in a vehicle terminal receives a message frame sent by a sender, and performs anomaly detection on the message frame according to the sender, receiving time and instruction data of the message frame. When an anomaly is found, the message frame and the anomaly detection result are sent to a bus monitoring system, which evaluates the attack level and dynamically adjusts the access rights of the sender and the message frame to the receiver. The present invention can improve the accuracy and efficiency of attack identification against vehicle terminals, and effectively avoid attacks on vehicle receivers by forged message frames.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method, system and computer storage medium for defending against attacks on automobile terminals based on a zero-trust mechanism. Background Art

[0002] At present, with the rapid development of intelligent connected cars, the trend of automobile intelligence and dataization is becoming more and more obvious. However, while automobile intelligence brings convenience and comfort to users, it also poses greater challenges to automobile data security and intelligent security.

[0003] The controller systems in the car terminal use the CAN bus to communicate. However, some network attacks often target the CAN bus as the first choice to impersonate or interfere with the normal communication messages of the controller systems, which brings certain security risks to the development of intelligent connected cars. Therefore, how to accurately identify fake or interfered message frames is the top priority in the field of attack and defense of intelligent connected cars.

[0004] Based on the above problems, this paper proposes a car terminal attack defense method, system and computer storage medium based on zero trust mechanism. Summary of the invention

[0005] In view of the above problems, the present invention proposes a vehicle terminal attack defense method based on a zero-trust mechanism, and the method specifically comprises the following steps:

[0006] S1. The sender in the car terminal sends a message frame to the receiver via the CAN bus;

[0007] The sender and receiver in the automobile terminal are both controller systems in the automobile terminal;

[0008] S2. The receiver in the car terminal receives the message frame and detects abnormalities of the message frame according to the sender, receiving time, and instruction data of the message frame;

[0009] When an abnormality is found, the receiving party sends the abnormal message frame and the abnormality detection result to the bus monitoring system in the vehicle terminal, and executes steps S3 to S4; otherwise, the receiving party processes the message frame and executes step S1;

[0010] S3. The bus monitoring system assesses the attack level of the sender and the message frame according to the message frame and the abnormality detection result;

[0011] S4. The bus monitoring system dynamically adjusts the access rights of the sender and the message frame to the receiver according to the result of the risk level assessment.

[0012] Furthermore, the step S2 specifically includes the following steps:

[0013] S201. The receiver receives the message frame, parses the message frame, obtains the sender F and instruction data G of the message frame, and obtains the receiving time of the message frame. ;

[0014] S202. The receiver determines whether the sender F is in the list of allowed access nodes;

[0015] The allowed access node list is stored in the receiving party;

[0016] If the sender F exists in the access-allowed node list and the status of the sender F in the access-allowed node list is access-allowed, execute step S203;

[0017] If the sender F exists in the list of nodes allowed to access and the status of the sender F in the list of nodes allowed to access is not allowed, the sender sets the current abnormality detection result to the second risk level, the receiver sends the sender F of the message frame, the instruction data G and the receiving time of the message frame to the bus monitoring system, and suspends the processing of the message frame;

[0018] If the sender F does not exist in the list of nodes allowed to access, the sender sets the current abnormality detection result to the first risk level, and the receiver sends the sender F of the message frame, the instruction data G and the receiving time of the message frame to the bus monitoring system, and suspends the processing of the message frame;

[0019] S203. The receiver obtains the last reception time of the message frame sent by the sender ;

[0020] S204. Receiver calculation and The difference is equal to ;

[0021] When the difference is less than or equal to the preset threshold When the receiving party sets the current abnormality detection result to the second risk level, and sends the sender, instruction data and the receiving time of the message frame in the message frame to the bus monitoring system, and suspends the processing of the message frame;

[0022] When the difference is greater than a preset threshold When , execute step S205;

[0023] S205. The receiver obtains the receiving time from the receiving log Previous preset time In the message frame sent by the sender F, the command data { };

[0024] in Indicated in to The command data corresponding to the nth message frame sent from sender F within the time period, n is to The total number of message frames sent from sender F during the time period;

[0025] in, ;

[0026] The receiving log is stored at the receiving party, and each data entry in the receiving log stores the message frames sent by each sender and received by the receiving party, as well as the receiving time corresponding to each message frame;

[0027] S206. The receiver obtains the time in the receiving log to The command data set corresponding to any continuous n message frames within the time period { }, and execute step S207;

[0028] in for to The command data set corresponding to the mth consecutive n message frames in the time period; m is to The number of instruction data sets corresponding to n consecutive message frames within a time period;

[0029] in, ;

[0030] in, The command data corresponding to the nth message frame in the command data set corresponding to the mth consecutive n message frames;

[0031] S207. When the instruction data set { There is a command data set in} = ;when In and{ } The same, and There are r% of instruction data and { }If the same, execute S201;

[0032] When the instruction data set { The command data corresponding to the last message frame in any command data set in} is the same as If they are not the same, the receiver sets the current abnormality detection result to the first risk level, sends the sender, instruction data and the receiving time of the message frame in the message frame to the bus monitoring system, and suspends the processing of the message frame;

[0033] When the instruction data set { There is a command data set in} = ;when In and{ } The same, and There are less than or equal to r% of instruction data and { } are the same, the receiver sets the current abnormality detection result to the second risk level, and sends the sender, instruction data and receiving time of the message frame in the message frame to the bus monitoring system, and suspends processing of the message frame.

[0034] Furthermore, the r% is any value between 60% and 100%.

[0035] The present invention also proposes a vehicle terminal attack defense system based on a zero-trust mechanism, the system comprising a sender, a receiver, and a bus monitoring system in the vehicle terminal;

[0036] The sender and receiver in the automobile terminal are both controller systems in the automobile terminal;

[0037] The sender sends a message frame to the receiver via the CAN bus;

[0038] The receiving party receives the message frame, and performs abnormality detection on the message frame according to the sender, receiving time, and instruction data of the message frame; when an abnormality is found, the receiving party sends the abnormal message frame and the abnormality detection result to the bus monitoring system in the vehicle terminal; otherwise, the receiving party processes the message frame and receives the next message frame;

[0039] The bus monitoring system assesses the attack level of the sender and the message frame according to the message frame and the abnormality detection result, and dynamically adjusts the access rights of the sender and the message frame to the receiver according to the result of the risk level assessment.

[0040] The present invention also proposes a computer storage medium, which stores a program code. The program code can be executed by a processor to provide a zero-trust-based automobile terminal attack defense method.

[0041] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above description and other purposes, features and advantages of the present invention more obvious and easy to understand, the preferred embodiments are specifically cited and described in detail as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0043] Figure 1 This is a structural diagram of a zero-trust-based automotive terminal attack defense system. DETAILED DESCRIPTION

[0044] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0045] In the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be connected, detachably connected, or integrated; it can be mechanically connected or electrically connected; it can be directly connected or indirectly connected through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0046] Embodiment 1

[0047] The present invention proposes a vehicle terminal attack defense method based on a zero-trust mechanism, and the method specifically comprises the following steps:

[0048] S1. The sender in the car terminal sends a message frame to the receiver via the CAN bus;

[0049] The sender and receiver in the automobile terminal are both controller systems in the automobile terminal;

[0050] S2. The receiver in the car terminal receives the message frame and detects abnormalities of the message frame according to the sender, receiving time, and instruction data of the message frame;

[0051] When an abnormality is found, the receiving party sends the abnormal message frame and the abnormality detection result to the bus monitoring system in the vehicle terminal, and executes steps S3 to S4; otherwise, the receiving party processes the message frame and executes step S1;

[0052] S3. The bus monitoring system assesses the attack level of the sender and the message frame according to the message frame and the abnormality detection result;

[0053] S4. The bus monitoring system dynamically adjusts the access rights of the sender and the message frame to the receiver according to the result of the risk level assessment.

[0054] Furthermore, the step S2 specifically includes the following steps:

[0055] S201. The receiver receives the message frame, parses the message frame, obtains the sender F and instruction data G of the message frame, and obtains the receiving time of the message frame. ;

[0056] S202. The receiver determines whether the sender F is in the list of allowed access nodes;

[0057] The allowed access node list is stored in the receiving party;

[0058] Each row in the allowed access node list stores a sender ID and a status corresponding to the sender;

[0059] The status includes: access allowed, access not allowed;

[0060] If the sender F exists in the access-allowed node list and the status of the sender F in the access-allowed node list is access-allowed, execute step S203;

[0061] If the sender F exists in the list of nodes allowed to access and the status of the sender F in the list of nodes allowed to access is not allowed, the sender sets the current abnormality detection result to the second risk level, the receiver sends the sender F of the message frame, the instruction data G and the receiving time of the message frame to the bus monitoring system, and suspends the processing of the message frame;

[0062] If the sender F does not exist in the list of nodes allowed to access, the sender sets the current abnormality detection result to the first risk level, and the receiver sends the sender F of the message frame, the instruction data G and the receiving time of the message frame to the bus monitoring system, and suspends the processing of the message frame;

[0063] S203. The receiver obtains the last reception time of the message frame sent by the sender ;

[0064] S204. Receiver calculation and The difference is equal to ;

[0065] When the difference is less than or equal to the preset threshold When the receiving party sets the current abnormality detection result to the second risk level, and sends the sender, instruction data and the receiving time of the message frame in the message frame to the bus monitoring system, and suspends the processing of the message frame;

[0066] When the difference is greater than a preset threshold When , execute step S205;

[0067] S205. The receiver obtains the receiving time from the receiving log Previous preset time In the message frame sent by the sender F, the command data { };

[0068] in Indicated in to The command data corresponding to the nth message frame sent from sender F within the time period, n is to The total number of message frames sent from sender F during the time period;

[0069] in, ;

[0070] The receiving log is stored at the receiving party, and each data entry in the receiving log stores the message frames sent by each sender and received by the receiving party, as well as the receiving time corresponding to each message frame;

[0071] S206. The receiver obtains the time in the receiving log to The command data set corresponding to any continuous n message frames within the time period { }, and execute step S207;

[0072] in for to The command data set corresponding to the mth consecutive n message frames in the time period; m is to The number of instruction data sets corresponding to n consecutive message frames within a time period; For preset time, ;

[0073] in, ;

[0074] in, The command data corresponding to the nth message frame in the command data set corresponding to the mth consecutive n message frames;

[0075] S207. When the instruction data set { There is a command data set in} = ;when In and{ } The same, and There are r% of instruction data and { }If the same, execute S201;

[0076] When the instruction data set { The command data corresponding to the last message frame in any command data set in} is the same as If they are not the same, the receiver sets the current abnormality detection result to the first risk level, sends the sender, instruction data and the receiving time of the message frame in the message frame to the bus monitoring system, and suspends the processing of the message frame;

[0077] When the instruction data set { There is a command data set in} = ;when In and{ } The same, and There are less than or equal to r% of instruction data and { } are the same, the receiver sets the current abnormality detection result to the second risk level, and sends the sender, instruction data and receiving time of the message frame in the message frame to the bus monitoring system, and suspends processing of the message frame.

[0078] Furthermore, the r% is any value between 60% and 100%.

[0079] Furthermore, the step S3 specifically includes the following steps:

[0080] S301. After the bus monitoring system receives the abnormal detection result sent by the receiver and the sender, instruction data and receiving time of the message frame in the message frame, when the abnormal detection result is the second risk level, the bus monitoring system sends a first inquiry instruction to the sender;

[0081] The first query instruction includes instruction data and a recipient of the message frame;

[0082] When the abnormality detection result is the first risk level, the bus monitoring system sets the message frame to the first attack level;

[0083] S302. After receiving the first query instruction, the sender obtains the sending time from the sending log. All data items in the range; where The average interval between sending message frames of the sender;

[0084] The sending log is stored on the sender, and multiple data entries are stored in the sending log, each of which includes the sender, the receiver, the sending time, and the instruction data;

[0085] S303. The sender determines that whether there is a data entry in all data entries within the range that has the same instruction data and recipient as the instruction data in the received first inquiry instruction, and feeding back the determination result to the bus monitoring system;

[0086] S304. After the bus monitoring system receives the judgment result, when the judgment result is existence, the bus monitoring system sets the message frame to no attack level;

[0087] When the judgment result is that it does not exist, the bus monitoring system sets the message frame to the first attack level.

[0088] Furthermore, the step S4 specifically includes the following steps:

[0089] S401. When the message frame has no attack level, the bus monitoring system notifies the receiver corresponding to the message frame to process the message frame, and executes step S1;

[0090] When the message frame is at the first attack level, the bus monitoring system notifies the receiver corresponding to the message frame to stop processing the message frame, and notifies the receiver to determine whether the sender corresponding to the message frame exists in the receiver's allowed access node list;

[0091] If it does not exist, the bus monitoring system notifies the receiver corresponding to the message frame to discard the message frame;

[0092] If yes, execute step S402;

[0093] S402. The bus monitoring system notifies the corresponding receiver of the message frame and sets the state of the sender of the message frame in the list of nodes allowed to be accessed by the receiver to not allow access;

[0094] S403. The bus monitoring system randomly generates a number X and sends a synchronization instruction to both the sender and the receiver corresponding to the message frame;

[0095] The synchronization instruction includes a number X, and a sender ID and a receiver ID corresponding to the message frame;

[0096] S404. After receiving the synchronization instruction, the sender adds a digit X to the beginning of the sender ID as the sender's new ID when sending a message frame to the receiver;

[0097] After receiving the synchronization instruction, the receiver adds the new ID of the sender to the receiving log in the receiver, and sets the status corresponding to the new ID of the sender to allow access.

[0098] Furthermore, the method further comprises:

[0099] After receiving the message frame, the receiver obtains the instruction data in the message frame, and processes the instruction data when the instruction data is the first instruction data; and executes steps S1 to S4 when the instruction data is the second instruction data;

[0100] The first instruction data is instruction data that will affect the normal driving of the vehicle;

[0101] The second instruction data is instruction data that does not affect the normal driving of the vehicle.

[0102] Embodiment 2

[0103] A vehicle terminal attack defense system based on a zero-trust mechanism, the system comprising a sender, a receiver, and a bus monitoring system in the vehicle terminal;

[0104] The sender and receiver in the automobile terminal are both controller systems in the automobile terminal;

[0105] The sender sends a message frame to the receiver via the CAN bus;

[0106] The receiving party receives the message frame, and performs abnormality detection on the message frame according to the sender, receiving time, and instruction data of the message frame; when an abnormality is found, the receiving party sends the abnormal message frame and the abnormality detection result to the bus monitoring system in the vehicle terminal; otherwise, the receiving party processes the message frame and receives the next message frame;

[0107] The bus monitoring system assesses the attack level of the sender and the message frame according to the message frame and the abnormality detection result, and dynamically adjusts the access rights of the sender and the message frame to the receiver according to the result of the risk level assessment.

[0108] Embodiment 3

[0109] A computer storage medium storing a program code, wherein the program code can be executed by a processor to implement a method for defending against attacks on automobile terminals based on a zero-trust mechanism in Example 1.

[0110] The beneficial effects of the invention are as follows:

[0111] 1. The present invention dynamically monitors and analyzes the received message frames through the receiver and the bus monitoring system to determine whether the message frames are attacked, thereby dynamically adjusting the access rights of the sender and the processing method for the message frames, thereby improving the accuracy of judging the car attack and the coping ability;

[0112] 2. In the present invention, the receiver evaluates the risk level of the current message frame according to the receiving time interval, whether the sender exists in the allowed access list, and the sender's sending behavior for continuous frames, thereby improving the ability to identify forged message frames;

[0113] 3. The bus monitoring system in the present invention dynamically adjusts the ID value of the sender for a certain receiver, effectively avoiding attacks on the receiver by forged message frames, and improving the overall security of the system.

[0114] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for defending against automobile terminal attacks based on a zero-trust mechanism, characterized in that: The method specifically comprises the following steps: S1. The sender in the car terminal sends a message frame to the receiver via the CAN bus; The sender and receiver in the automobile terminal are both controller systems in the automobile terminal; S2. The receiver in the car terminal receives the message frame and detects abnormalities of the message frame according to the sender, receiving time, and instruction data of the message frame; When an abnormality is found, the receiving party sends the abnormal message frame and the abnormality detection result to the bus monitoring system in the vehicle terminal, and executes steps S3 to S4; otherwise, the receiving party processes the message frame and executes step S1; The step S2 specifically includes the following steps: S201. The receiver receives the message frame, parses the message frame, obtains the sender F and instruction data G of the message frame, and obtains the receiving time of the message frame. ; S202. The receiver determines whether the sender F is in the list of allowed access nodes; The allowed access node list is stored in the receiving party; If the sender F exists in the access-allowed node list and the status of the sender F in the access-allowed node list is access-allowed, execute step S203; If the sender F exists in the list of nodes allowed to access and the status of the sender F in the list of nodes allowed to access is not allowed, the sender sets the current abnormality detection result to the second risk level, the receiver sends the sender F of the message frame, the instruction data G and the receiving time of the message frame to the bus monitoring system, and suspends the processing of the message frame; If the sender F does not exist in the list of nodes allowed to be accessed, the sender sets the current abnormality detection result to the first risk level, and the receiver sends the sender F of the message frame, the instruction data G and the receiving time of the message frame to the bus monitoring system, and suspends the processing of the message frame; S203. The receiver obtains the last reception time of the message frame sent by the sender ; S204. Receiver calculation and The difference is equal to ; When the difference is less than or equal to the preset threshold When the receiving party sets the current abnormality detection result to the second risk level, and sends the sender, instruction data and the receiving time of the message frame in the message frame to the bus monitoring system, and suspends the processing of the message frame; When the difference is greater than a preset threshold When , execute step S205; S205. The receiver obtains the receiving time from the receiving log Previous preset time In the message frame sent by the sender F, the command data { }; in Indicated in to The command data corresponding to the nth message frame sent from sender F within the time period, n is to The total number of message frames sent from sender F during the time period; in, ; The receiving log is stored at the receiving party, and each data entry in the receiving log stores the message frames sent by each sender and received by the receiving party, as well as the receiving time corresponding to each message frame; S206. The receiver obtains the time in the receiving log to The command data set corresponding to any continuous n message frames within the time period { }, and execute step S207; in for to The command data set corresponding to the mth consecutive n message frames in the time period; m is to The number of instruction data sets corresponding to n consecutive message frames within a time period; in, ; in, The command data corresponding to the nth message frame in the command data set corresponding to the mth consecutive n message frames; S207. When the instruction data set { There is a command data set in} = ;when In and{ } The same, and There are r% of instruction data and { }If the same, execute S201; When the instruction data set { The command data corresponding to the last message frame in any command data set in} is the same as If they are not the same, the receiver sets the current abnormality detection result to the first risk level, sends the sender, instruction data and the receiving time of the message frame in the message frame to the bus monitoring system, and suspends the processing of the message frame; When the instruction data set { There is a command data set in} = ;when In and{ } The same, and There are less than or equal to r% of instruction data and { } are the same, the receiver sets the current abnormality detection result to the second risk level, and sends the sender, instruction data and the receiving time of the message frame in the message frame to the bus monitoring system, and suspends the processing of the message frame; S3. The bus monitoring system assesses the attack level of the sender and the message frame according to the message frame and the abnormality detection result; The step S3 specifically includes the following steps: S301. After the bus monitoring system receives the abnormal detection result sent by the receiver and the sender, instruction data and receiving time of the message frame in the message frame, when the abnormal detection result is the second risk level, the bus monitoring system sends a first inquiry instruction to the sender; The first query instruction includes the instruction data and the recipient of the message frame; When the abnormality detection result is the first risk level, the bus monitoring system sets the message frame to the first attack level; S302. After receiving the first query instruction, the sender obtains the sending time from the sending log. All data items in the range; where The average interval between sending message frames of the sender; The sending log is stored on the sender, and multiple data entries are stored in the sending log, each of which includes the sender, the receiver, the sending time, and the instruction data; S303. The sender determines that whether there is a data entry in all data entries within the range that has the same instruction data and recipient as the instruction data in the received first inquiry instruction, and feeding back the determination result to the bus monitoring system; S304. After the bus monitoring system receives the judgment result, when the judgment result is existence, the bus monitoring system sets the message frame to no attack level; When the judgment result is that it does not exist, the bus monitoring system sets the message frame to the first attack level; S4. The bus monitoring system dynamically adjusts the access rights of the sender and the receiver of the message frame according to the results of the risk level assessment; The step S4 specifically includes the following steps: S401. When the message frame has no attack level, the bus monitoring system notifies the receiver corresponding to the message frame to process the message frame, and executes step S1; When the message frame is at the first attack level, the bus monitoring system notifies the receiver corresponding to the message frame to stop processing the message frame, and notifies the receiver to determine whether the sender corresponding to the message frame exists in the receiver's allowed access node list; If not, the bus monitoring system notifies the receiver corresponding to the message frame to discard the message frame; If yes, execute step S402; S402. The bus monitoring system notifies the receiver corresponding to the message frame and sets the state of the sender of the message frame in the list of nodes allowed to be accessed by the receiver to not allow access; S403. The bus monitoring system randomly generates a number X and sends a synchronization instruction to both the sender and the receiver corresponding to the message frame; The synchronization instruction includes a number X, and a sender ID and a receiver ID corresponding to the message frame; S404. After receiving the synchronization instruction, the sender adds a digit X to the beginning of the sender ID as the sender's new ID when sending a message frame to the receiver; After receiving the synchronization instruction, the receiver adds the new ID of the sender to the receiving log in the receiver, and sets the status corresponding to the new ID of the sender to allow access.

2. According to the zero-trust mechanism-based automobile terminal attack defense method of claim 1, it is characterized in that: The r% is equal to any value between 60% and 100%.

3. A vehicle terminal attack defense system based on zero trust mechanism, characterized in that: The system includes a sender, a receiver, and a bus monitoring system in a vehicle terminal; The sender and receiver in the automobile terminal are both controller systems in the automobile terminal; The sender sends a message frame to the receiver via the CAN bus; The receiving party receives the message frame, and performs abnormality detection on the message frame according to the sender, receiving time, and instruction data of the message frame; when an abnormality is found, the receiving party sends the abnormal message frame and the abnormality detection result to the bus monitoring system in the vehicle terminal; otherwise, the receiving party processes the message frame and receives the next message frame; The abnormality detection of the message frame includes the following steps: S201. The receiver receives the message frame, parses the message frame, obtains the sender F and instruction data G of the message frame, and obtains the receiving time of the message frame. ; S202. The receiver determines whether the sender F is in the list of allowed access nodes; The allowed access node list is stored in the receiving party; If the sender F exists in the access-allowed node list and the status of the sender F in the access-allowed node list is access-allowed, execute step S203; If the sender F exists in the list of nodes allowed to access and the status of the sender F in the list of nodes allowed to access is not allowed, the sender sets the current abnormality detection result to the second risk level, the receiver sends the sender F of the message frame, the instruction data G and the receiving time of the message frame to the bus monitoring system, and suspends the processing of the message frame; If the sender F does not exist in the list of nodes allowed to be accessed, the sender sets the current abnormality detection result to the first risk level, and the receiver sends the sender F of the message frame, the instruction data G and the receiving time of the message frame to the bus monitoring system, and suspends the processing of the message frame; S203. The receiver obtains the last reception time of the message frame sent by the sender ; S204. Receiver calculation and The difference is equal to ; When the difference is less than or equal to the preset threshold When the receiving party sets the current abnormality detection result to the second risk level, and sends the sender, instruction data and the receiving time of the message frame in the message frame to the bus monitoring system, and suspends the processing of the message frame; When the difference is greater than a preset threshold When , execute step S205; S205. The receiver obtains the receiving time from the receiving log Previous preset time In the message frame sent by the sender F, the command data { }; in Indicated in to The command data corresponding to the nth message frame sent from sender F within the time period, n is to The total number of message frames sent from sender F during the time period; in, ; The receiving log is stored at the receiving party, and each data entry in the receiving log stores the message frames sent by each sender and received by the receiving party, as well as the receiving time corresponding to each message frame; S206. The receiver obtains the time in the receiving log to The command data set corresponding to any continuous n message frames within the time period { }, and execute step S207; in for to The command data set corresponding to the mth consecutive n message frames in the time period; m is to The number of instruction data sets corresponding to n consecutive message frames within a time period; in, ; in, The command data corresponding to the nth message frame in the command data set corresponding to the mth consecutive n message frames; S207. When the instruction data set { There is a command data set in} = ;when In and{ } The same, and There are r% of instruction data and { }If the same, execute S201; When the instruction data set { The command data corresponding to the last message frame in any command data set in} is the same as If they are not the same, the receiver sets the current abnormality detection result to the first risk level, sends the sender, instruction data and the receiving time of the message frame in the message frame to the bus monitoring system, and suspends the processing of the message frame; When the instruction data set { There is a command data set in} = ;when In and{ } The same, and There are less than or equal to r% of instruction data and { } are the same, the receiver sets the current abnormality detection result to the second risk level, and sends the sender, instruction data and the receiving time of the message frame in the message frame to the bus monitoring system, and suspends the processing of the message frame; The bus monitoring system assesses the attack level of the sender and the message frame according to the message frame and the abnormality detection result, and dynamically adjusts the access rights of the sender and the message frame to the receiver according to the risk level assessment result; The bus monitoring system evaluates the attack level of the sender and the message frame according to the message frame and the abnormality detection result, specifically including the following steps: S301. After the bus monitoring system receives the abnormal detection result sent by the receiver and the sender, instruction data and receiving time of the message frame in the message frame, when the abnormal detection result is the second risk level, the bus monitoring system sends a first inquiry instruction to the sender; The first query instruction includes the instruction data and the recipient of the message frame; When the abnormality detection result is the first risk level, the bus monitoring system sets the message frame to the first attack level; S302. After receiving the first query instruction, the sender obtains the sending time from the sending log. All data items in the range; where The average interval between sending message frames of the sender; The sending log is stored on the sender, and multiple data entries are stored in the sending log, each of which includes the sender, the receiver, the sending time, and the instruction data; S303. The sender determines that whether there is a data entry in all data entries within the range that has the same instruction data and recipient as the instruction data in the received first inquiry instruction, and feeding back the determination result to the bus monitoring system; S304. After the bus monitoring system receives the judgment result, when the judgment result is existence, the bus monitoring system sets the message frame to no attack level; When the judgment result is that it does not exist, the bus monitoring system sets the message frame to the first attack level; The access rights of the sender and the message frame to the receiver are dynamically adjusted according to the result of the risk level assessment, which specifically includes the following steps: S401. When the message frame has no attack level, the bus monitoring system notifies the receiver corresponding to the message frame to process the message frame, and executes step S1; When the message frame is at the first attack level, the bus monitoring system notifies the receiver corresponding to the message frame to stop processing the message frame, and notifies the receiver to determine whether the sender corresponding to the message frame exists in the receiver's allowed access node list; If not, the bus monitoring system notifies the receiver corresponding to the message frame to discard the message frame; If yes, execute step S402; S402. The bus monitoring system notifies the receiver corresponding to the message frame and sets the state of the sender of the message frame in the list of nodes allowed to be accessed by the receiver to not allow access; S403. The bus monitoring system randomly generates a number X and sends a synchronization instruction to both the sender and the receiver corresponding to the message frame; The synchronization instruction includes a number X, and a sender ID and a receiver ID corresponding to the message frame; S404. After receiving the synchronization instruction, the sender adds a digit X to the beginning of the sender ID as the sender's new ID when sending a message frame to the receiver; After receiving the synchronization instruction, the receiver adds the new ID of the sender to the receiving log in the receiver, and sets the status corresponding to the new ID of the sender to allow access.

4. A computer storage medium storing a program code, wherein the program code can be executed by a processor to execute the method according to any one of claims 1 to 2.

Images